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Why GAO Did This Study 

The Visa Waiver Program enables 
citizens of 27 countries to travel to 
the United States for tourism or 
business for 90 days or less without 
obtaining a visa. In fiscal year 
2004, more than 15 million people 
entered the country under the 
program. After the September 11, 
2001, terrorist attacks, the risks 
that aliens would exploit the 
program to enter the United States 
became more of a concern. In this 
report, we (1) describe the Visa 
Waiver Program's benefits and 
risks, (2) examine the U.S. 
government's process for assessing 
potential risks, and (3) assess 
actions taken to mitigate these 
risks. We met with U.S. embassy 
officials in six program countries, 
and reviewed relevant laws, 
procedures, and reports on 
participating countries. 



What GAO Recommends 



GAO is making a series of 
recommendations to DHS to 
strengthen its ability to assess and 
mitigate the program's risks, such 
as providing more resources to the 
program's monitoring unit and 
issuing standards for the reporting 
of lost and stolen passport data. 
Congress should also consider 
establishing a deadline for the 
mandated biennial report to 
Congress. 

DHS and State generally agreed 
with the report. DHS either agreed 
with, or said that it would consider, 
all of our recommendations, but 
did not agree that Congress should 
establish a deadline for the biennial 
report. 

www.gao.gov/cgi-bin/getrpt7GAO-06-854. 

To view the full product, including the scope 
and methodology, click on the link above. 
For more information, contact Jess Ford at 
(202) 512-4128 orfordj@gao.gov. 



What GAO Found 

The Visa Waiver Program has many benefits as well as some inherent risks. 
It facilitates travel for millions of people and eases consular workload, but 
poses challenges to border inspectors, who, when screening visa waiver 
travelers, may face language barriers or lack time to conduct in-depth 
interviews. Furthermore, stolen passports from visa waiver countries are 
prized travel documents among terrorists, criminals, and immigration law 
violators, creating an additional risk. While the Department of Homeland 
Security (DHS) has intercepted many fraudulent documents at U.S. ports of 
entry, DHS officials acknowledged that an undetermined number of 
inadmissible aliens may have entered the United States using a stolen or lost 
passport from a visa waiver country. 

The U.S. government's process for assessing the risks of the Visa Waiver 
Program has weaknesses. In 2002, Congress mandated that, every 2 years, 
DHS review the effect that each country's continued participation in the 
program has on U.S. law enforcement and security interests, but did not set 
a reporting deadline. In 2004, DHS established a unit to oversee the program 
and conduct these reviews. We identified several problems with the 2004 
review process, as key stakeholders were not consulted during portions of 
the process, preparation for the in-country site visits was not consistent, and 
the final reports were untimely. Furthermore, DHS cannot effectively 
achieve its mission to monitor and report on ongoing law enforcement and 
security concerns in visa waiver countries due to insufficient resources. 

DHS has taken some actions to mitigate the program's risks; however, the 
U.S. government has faced difficulties in further mitigating these risks. In 
particular, the department has not established time frames and operating 
procedures regarding timely stolen passport reporting — a program 
requirement since 2002. Furthermore, DHS has sought to require the 
reporting of lost and stolen passport data to the United States and the 
International Criminal Police Organization (Interpol), but it has not issued 
clear reporting guidelines to participating countries. While most visa waiver 
countries participate with Interpol's database, four do not. DHS is not using 
Interpol's data to its full potential as a border screening tool because DHS 
does not automatically access the data at primary inspection. 

Visa Waiver Program Admissions, Fiscal Years 2002 through 2004 

Fiscal year 



2003 



2004 



12,857,131 



13,318,229 



15,603,400 



1 2 3 4 5 
Admissions in millions 

Source: GAO analysis of DHS data. 
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^ G A O 

_ Accountability * Integrity * Reliability 

United States Government Accountability Office 
Washington, DC 20548 



July 28, 2006 

The Honorable Jim Sensenbrenner, Jr. 
Chairman 

Committee on the Judiciary 
House of Representatives 

Dear Mr. Chairman: 

In fiscal year 2004, more than 15 million travelers entered the United 
States under the Visa Waiver Program. This program facilitates 
international travel and commerce, and eases consular workload at 
overseas posts, by enabling citizens of 27 participating countries to travel 
to the United States for tourism or business for 90 days or less without 
first obtaining a visa 1 from U.S. embassies and consulates. 2 The Visa 
Waiver Program was created as a pilot program in 1986, 3 and it became a 
permanent program in 2000, 4 about 1 year prior to the terrorist attacks of 
September 11, 2001. Participating countries were selected because their 
citizens had demonstrated a pattern of compliance with U.S. immigration 
laws, and the governments of these countries granted reciprocal visa-free 
travel to U.S. citizens. After the terrorist attacks, the potential risks of the 
program became more of a concern. In particular, convicted terrorist 
Zacarias Moussaoui and "shoe-bomber" Richard Reid both boarded flights 
to the United States with passports issued by Visa Waiver Program 
countries. In May 2002, Congress mandated that the Department of 
Homeland Security (DHS) evaluate and report to Congress at least 
biennially on the effect that each country's continued participation in the 



lr The United States also issues visas to those who intend to immigrate to the United States. 
In this report, we use the term "visa" to refer to nonimmigrant visas only. 

2 The participating countries are Andorra, Australia, Austria, Belgium, Brunei, Denmark, 
Finland, France, Germany, Iceland, Ireland, Italy, Japan, Liechtenstein, Luxembourg, 
Monaco, the Netherlands, New Zealand, Norway, Portugal, San Marino, Singapore, 
Slovenia, Spain, Sweden, Switzerland, and the United Kingdom (see app. II for a map of these 
countries). Canada and Bermuda are not participants in the Visa Waiver Program; however, 
nationals of Canada and Bermuda may, under certain circumstances, qualify for visa-free 
travel to the United States. 

3 The Immigration Reform and Control Act of 1986, P.L. 99-603. 
4 The Visa Waiver Permanent Program Act, P.L. 106-396. 
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program has on U.S. law enforcement and security interests. 5 Effective 
oversight of the Visa Waiver Program is essential to find the right balance 
between facilitating legitimate travel and screening for potential terrorists, 
criminals, and others that may pose law enforcement and immigration 
concerns. 

In response to your request, this report (1) describes the Visa Waiver 
Program's benefits and potential risks; (2) examines the U.S. government's 
process for assessing the program's risks; and (3) assesses actions taken 
to mitigate these risks. 

To identify the benefits of the program, we reviewed relevant 
documentation, including DHS's Office of the Inspector General (OIG) 
reports and our 2002 report on the implications of eliminating the 
program. 6 We also interviewed political, economic, consular, commercial, 
and law enforcement officials at U.S. embassies in six Visa Waiver 
Program countries. To determine the risks the Visa Waiver Program, we 
interviewed officials from DHS's National Targeting Center, Intelligence 
and Analysis Directorate, and Forensic Document Laboratory. In addition, 
we observed fraudulent document detection training of Customs and 
Border Protection (CBP) agents at the Federal Law Enforcement Training 
Center. To evaluate the U.S. government's efforts to assess and mitigate 
these risks, we analyzed the laws governing the program, relevant 
regulations and agency operating procedures, and OIG reports. We also 
examined 15 of the 25 completed reports from the 2004 review process 
assessing the participation of Visa Waiver Program countries. 7 As of June 
2006, the remaining 10 assessments were pending classification review. 
We met with officials from several DHS component agencies and offices, 
the Department of State's (State) Consular Affairs Bureau and its Europe 
and Eurasia Bureau, and the International Criminal Police Organization 
(Interpol) in Lyon, France. We also met with the Department of Justice's 
(Justice) Interpol-U.S. National Central Bureau in Washington, D.C., which 
facilitates international law enforcement cooperation among the United 
States and Interpol and its other member countries. In addition to U.S. 



5 Prior to this change, DHS was required to report at least once every 5 years. See the 
Enhanced Border Security and Visa Entry Reform Act, P.L 107-173. 

6 See GAO, Border Security: Implications of Eliminating the Visa Waiver Program, 
GAO-03-38 (Washington, D.C.: Nov. 22, 2002). 

7 As of June 2006, the reviews of the remaining two participating countries — Italy and 
Portugal — were in process. 
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officials in the six Visa Waiver Program countries, we spoke with foreign 
government officials in three of these countries. We conducted our 
evaluation from September 2005 through June 2006 in accordance with 
generally accepted government auditing standards. 



RGSllltS in Brief ^ e ^ sa Waiver P r °g ram provides many benefits to the United States; 

^ however, travelers attempting to enter the United States under the 

program may pose security or law enforcement risks, including 
immigration law violations, because they are not subject to the same 
degree of screening as non-visa-waiver travelers. The program was 
designed to boost international business and tourism, and allows State to 
shift its consular resources to posts with higher-risk visa applicants. 
However, travelers visiting the United States under the Visa Waiver 
Program are not subject to the same degree of screening as travelers with 
visas because they need not be interviewed by a consular officer before 
arriving at a U.S. port of entry. In addition, border inspectors at U.S. ports 
of entry are disadvantaged in screening visa waiver travelers because they 
may not know the alien's language or local fraudulent document trends in 
the alien's home country, nor have the time to conduct an extensive 
interview. In contrast, visa-issuing officers at U.S. embassies generally 
have more time to interview applicants — often in the applicants' native 
language — and have more country-specific knowledge of passports and 
fraud trends. Furthermore, lost and stolen passports from visa waiver 
countries are highly prized among those travelers seeking to conceal their 
true identities or nationalities, creating an additional program risk. In our 
discussions with DHS officials, they acknowledged that an undetermined 
number of inadmissible aliens may have entered the United States using a 
stolen or lost passport from a visa waiver country, and, in fact, passports 
from Visa Waiver Program countries have been used illegally by travelers 
attempting to enter the United States. For example, from January through 
June 2005, at U.S. ports of entry, DHS confiscated 298 passports issued by 
Visa Waiver Program countries that travelers were attempting to use 
fraudulently for admission into the United States. Thus, there is a potential 
risk that the program could be exploited for illegal entry into the United 
States. 



DHS, in coordination with State and Justice, has developed a process for 
assessing the law enforcement and security risks of the Visa Waiver 
Program; this process has weaknesses, however. In 2002, Congress 
mandated that DHS review the security risks posed by each visa waiver 
country's participation in the program at least every 2 years. In 2004, DHS 
established the Visa Waiver Program Oversight Unit within the Office of 
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International Enforcement (OIE). 8 DHS conducted its first mandated 
biennial reviews in 2004, and determined that all of the countries it 
reviewed should remain in the program. 9 In general, the reviews contained 
an analysis of issues, such as individual countries' border controls, 
security over passports and national identity documents, and other 
matters relevant to law enforcement, immigration, and national security. 
However, we identified several problems with the country review process. 
Specifically, key interagency stakeholders, 10 such as embassies overseas, 
State's regional bureaus, and forensic document analysts were left out of 
portions of the 2004 country review process; preparation for the in-country 
site visits was not always consistent; and, the review process lacked clear 
criteria and guidance to make key judgments. Also, the country 
assessments prepared by DHS were not completed in a timely fashion and 
contained some dated information that did not necessarily reflect the 
current risks posed by a country's continued participation in the program. 
In particular, interagency teams conducted site visits as part of the country 
assessments from May through September 2004, and transmitted the final 
report to Congress more than 1 year later, in November 2005. Moreover, 
DHS has not provided sufficient resources to OIE to effectively monitor 
the risks posed by visa waiver countries on an ongoing basis. While the 
Visa Waiver Program Oversight Unit developed a strategic plan to monitor 
the program, it has been unable to implement this plan with its current 
staff of two full-time employees. In addition, DHS has not established 
points of contact within the U.S. embassies so it can communicate directly 
with foreign government contacts and field officials, who are best 
positioned to monitor compliance with the program's requirements and 
report on current events and issues of potential concern. Without this 
outreach, DHS is not able to leverage the existing resources at U.S. 
embassies in all visa waiver countries to obtain current information on 
potential risks, as well as countries' progress in addressing these risks. 



OIE is located in the Office of Policy Development under the direction of the Assistant 
Secretary of Homeland Security for Policy. 

9 DHS's Office of Policy began this review in early 2004, several months before the Visa 
Waiver Program Oversight Unit was established in July of that year. 

10 The interagency working group charged in 2004 with assessing participating countries' 
adherence to the program's statutory requirements comprised officials from Justice's 
Office of International Affairs, State's Bureau of Consular Affairs, and several components 
within DHS, including the Intelligence and Analysis Directorate, CBP's Office of Field 
Operations, and Immigration and Customs Enforcement's Forensic Document Laboratory, 
among others. Representatives from some of these agencies formed the in-country site visit 
teams. 
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DHS has taken some actions to mitigate the risks of the Visa Waiver 
Program, including terminating the use of the German temporary passport 
under the program; however, the department has faced difficulties in 
further mitigating the risks of the program, particularly regarding lost and 
stolen passport reporting — a key vulnerability. For example, not all 
countries have consistently reported their data to the United States on 
stolen blank passports, even though reporting such data is vital to 
mitigating program risks. In one instance, a visa waiver country reported 
to the United States the theft of nearly 300 blank passports more than 9 
years after the theft occurred. In 2002, timely reporting of such thefts 
became a statutory requirement for continued participation in the 
program, but DHS has not issued standard operating procedures for 
obtaining these data. DHS has also sought to expand this requirement to 
include the reporting of data, to the United States and Interpol, 11 about lost 
and stolen issued 12 (as well as blank) passports; however, the United 
States lacks a centralized mechanism for foreign governments to report all 
stolen passports, and DHS has not identified the U.S. government entity to 
which participating countries should report this information. While most 
visa waiver countries contribute to Interpol's database, four do not. 
Moreover, some countries that do contribute do not do so on a regular 
basis, according to Interpol officials. In addition, Interpol's data on lost 
and stolen travel documents is not automatically accessible to U.S. border 
inspectors at primary inspection — one reason why it is not an effective 
border screening tool, according to DHS, State, and Justice officials. 
According to the Secretary General of Interpol, until DHS can 
automatically query Interpol's data, the United States will not have an 
effective screening tool for checking passports. However, DHS has not yet 
finalized a plan to acquire this systematic access to Interpol's data. 

We are making a series of recommendations to DHS to strengthen its 
ability to assess the risks of the Visa Waiver Program, including a 
recommendation to create real-time monitoring mechanisms to improve 
communication between the department and overseas posts, and to 



Interpol is the world's largest international police organization, with 184 member 
countries. Created in 1923, it facilitates cross-border police cooperation, and supports and 
assists all organizations, authorities, and services whose mission is to prevent or combat 
international crime. In July 2002, Interpol established a database on lost and stolen travel 
documents. As of June 2006, the database contained about 11.6 million records of lost and 
stolen passports. 

12 Issued passports have been officially personalized with the bearer's biographical 
information. 
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provide additional resources for the Visa Waiver Program Oversight Unit. 
We are also making a series of recommendations to mitigate the program's 
risks, including communicating clear standard operating procedures for 
the reporting of lost and stolen, blank and issued, passport data. Finally, 
we are including a matter for congressional consideration: to improve the 
timeliness of DHS's assessments of the risks of each country's continued 
participation in the program, Congress should consider establishing a 
deadline by which the department must complete its biennial country 
assessments and report to Congress. 

We received written comments from DHS, State, and Interpol, which we 
have reprinted in appendices IV, V, and VI, respectively. DHS either 
agreed with, or stated that it is considering, all of our recommendations. 
Regarding our matter for congressional consideration, DHS did not appear 
to support the establishment of a deadline for the biennial report to 
Congress. Instead, DHS suggested that Congress should require 
continuous and ongoing evaluation of the risks of each country's 
continued participation in the program. We agree that continuous and 
ongoing evaluation is necessary, which is why we recommended that DHS 
create real-time monitoring arrangements and provide additional 
resources to the Visa Waiver Program Oversight Unit to achieve this goal. 
Regarding the mandated biennial country assessments, we believe that 
they can serve a useful purpose if they are completed in a timely fashion. 
State agreed with our report, and welcomed our recommendations calling 
for enhanced communication to and from DHS, and for the timely 
reporting of lost and stolen passport data. Interpol did not comment on 
our recommendations, but provided information about its lost and stolen 
travel document database and tools that it has developed to allow law 
enforcement officers to instantly check this database at airports and other 
border entry points. 



Background. ^ e I mrm § ra ti° n Reform and Control Act of 1986 created the Visa Waiver 

o Program as a pilot program. 13 It was initially envisioned as an immigration 

control and economic promotion program, according to State. 
Participating countries were selected because their citizens had a 
demonstrated pattern of compliance with U.S. immigration laws, and the 



13 P.L. 99-603. 
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governments of these countries granted reciprocal visa-free travel to U.S. 
citizens. In 2000, the program became permanent under the Visa Waiver 
Permanent Program Act. 14 In 2002, we reported on the legislative 
requirements to which countries must adhere before they are eligible for 
inclusion in the Visa Waiver Program. 15 In general, these are the 
requirements: 

• A low nonimmigrant visa refusal rate. To qualify for visa waiver status, a 
country must maintain a refusal rate of less than 3 percent for its citizens 
who apply for business and tourism visas. 

• A machine-readable passport program. The country must certify that it 
issues machine-readable passports to its citizens. As of June 26, 2005, all 
travelers are required to have a machine-readable passport to enter the 
United States under this program. 

• Reciprocity. The country must offer visa-free travel for U.S. citizens. 

Figure 1 shows the number of foreign nationals admitted to the United 
States under the program in recent years (see app. Ill for more detailed 
admissions statistics). Persons entering the United States under the Visa 
Waiver Program must 

• have a valid passport issued by the participating country and be a national 
of that country; 

• be seeking entry for 90 days or less as a temporary visitor for business or 
tourism; 16 

• have been determined by CBP at the U.S. port of entry to represent no 
threat to the welfare, health, safety, or security of the United States; 

• have complied with conditions of any previous admission under the 
program (for example, individuals must have stayed in the United States 



14 P.L. 106-396. 
15 GAO-03-38. 

"According to State, the Visa Waiver Program is a substitute entry mechanism for 
nonimmigrant, short-term, business, and tourism visas only; it does not apply to students, 
temporary workers, and others who require visas to enter the United States. 
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for 90 days or less during prior visa waiver visits); 

• if entering by air or sea, possess a round-trip transportation ticket issued 
by a carrier that has signed an agreement with the U.S. government to 
participate in the program, and must have arrived in the United States 
aboard such a carrier; and 

• if entering by land, have proof of financial solvency and a domicile abroad 
to which they intend to return. 



Figure 1 : Foreign Nationals Admitted under the Visa Waiver Program, from Fiscal 
Years 2002 through 2004 

Total nonimmigrant admissions in millions 
16 



14 



12 
10 
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2002 2003 2004 
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Source: GAO analysis of DHS data. 



Note: As of June 2006, CBP officials stated that admissions data from fiscal year 2005 are not yet 
available. 

Following the events of September 11, 2001, Congress passed additional 
laws to strengthen border security policies and procedures, and DHS and 
State instituted other policy changes that have affected a country's 
qualifications for participating in the Visa Waiver Program. For example, 
all passports issued after October 26, 2005, must contain a digital 
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photograph printed in the document; passports issued to visa waiver 
travelers after October 26, 2006, must be electronic (e-passports). 17 E- 
passports aim to enhance border security by making it more difficult to 
misuse the passport to gain entry into the United States. Travelers with 
passports issued after the deadline that do not meet these requirements 
must obtain a visa from a U.S. embassy or consulate overseas before 
departing for the United States. In addition, the May 2002 Enhanced 
Border Security and Visa Reform Act required that participating countries 
certify that the theft of their blank passports is reported to the U.S. 
government in a timely manner. Moreover, the act increased the 
frequency — from once every 5 years to once every 2 years — of mandated 
assessments of the effect of each country's continued participation in the 
Visa Waiver Program on U.S. security, law enforcement, and immigration 
interests. 



Visa Waiver Program 
Has Benefits and 
Risks 



The Visa Waiver Program has many benefits, including facilitating 
international travel for millions of foreign citizens seeking to visit the 
United States each year, creating substantial economic benefits to the 
United States, and allowing State to allocate resources to visa-issuing 
posts in countries with higher-risk applicant pools. However, there are 
inherent security and law enforcement risks in the program that pose 
challenges to the United States. 



Visa Waiver Program 
Facilitates Travel to the 
United States 



The Visa Waiver Program was created to facilitate international travel 
without jeopardizing the welfare or security of the United States, 
according to the program's legislative history. In fact, visa waiver travelers 
have represented about one-half of all nonimmigrant admissions to the 
United States in recent years, as demonstrated by figure 2 below. 
According to economic and commercial officers at several of the U.S. 
embassies we visited, visa-free travel to the United States boosts 
international business travel and tourism, as well as airline revenues, and 



In general, e-passports will contain a chip embedded in the passport that will store the 
same information that is printed on the data page of the passport, such as name, date of 
birth, gender, place of birth, dates of passport issuance and expiration, place of issuance, 
passport number, and a photo image of the bearer. In addition, e-passports will hold a 
unique identification number and a digital signature to protect the stored data from 
alteration. E-passports provide two key pieces of information: the digital signature and the 
digital image of the passport holder. Digital signatures provide a higher level of security for 
the passport by providing a means to electronically verify the authenticity of the data on 
the chip, including the traveler's photograph and biographical information. 
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creates substantial economic benefits to the United States. In its report 
accompanying the 2000 bill to make the program permanent, the House 
Committee on the Judiciary acknowledged the program's importance to 
the U.S. travel and tourism industry, and the benefit it provides to 
American citizens by allowing reciprocal visa-free travel to visa waiver 
countries. As we reported in 2002, any decision to eliminate the program 
could discourage some business and tourism in the United States. 18 In 
addition, visa waiver countries could begin requiring visas for U.S. citizens 
traveling to the 27 participating countries for temporary business or 
tourism purposes, which would impose a burden of additional cost and 
time on U.S. travelers to these countries. 



Figure 2: Visa Waiver Program Admissions as a Percentage of Total Nonimmigrant 
Admissions into the United States, Fiscal Years 2002 through 2004 
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Visa Waiver Program admissions 
Source: GAO analysis of DHS data. 

Note: Data on total nonimmigrant admissions are derived from DHS's 2004 Yearbook of Immigration 
Statistics. These data do not include visa-free entries by citizens of Canada or travelers entering the 
U.S. territory of Guam under its visa waiver program. 



lf, GAO-03-38. 
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Moreover, the program allows State to allocate its resources to visa- 
issuing posts in countries with higher-risk applicant pools. In 2002, we 
reported that eliminating the program would increase State's resource 
requirements. 19 Specifically, if the program were eliminated, we estimated 
that State's initial costs at that time to process the additional workload 
would likely range between $739 million and $1.28 billion and that annual 
recurring costs would likely range between $522 million and $810 million. 
For example, millions of visa waiver travelers who have benefited from 
visa-free travel would need to obtain a visa to travel to the United States if 
the program did not exist. Furthermore, we reported that U.S. officials, 
including those from State as well as from some law enforcement 
agencies, said that eliminating the Visa Waiver Program could have 
negative implications for U.S. relations with governments of participating 
countries and could impair their cooperation in efforts to combat 
terrorism. 



The Visa Waiver Program can pose risks to U.S. security, law enforcement, 
and immigration interests because some foreign citizens may exploit the 
program to enter the United States. In particular, visa waiver travelers are 
not subject to the same degree of screening as those travelers who must 
first obtain a visa before arriving in the United States. Furthermore, lost 
and stolen passports from visa waiver countries could be used by 
terrorists, criminals, and immigration law violators to gain entry into the 
United States. 

Visa Waiver Travelers and Visa Since September 11, 2001, the visa issuance process has taken on greater 
Applicants Face Different significance as an antiterrorism tool, as we have previously reported. 20 

Levels of Screening Those travelers who must apply for visas before traveling to the United 

States receive two levels of screening before entering the country (see fig. 

3). 21 However, visa waiver travelers are first screened in person by a CBP 



Visa Waiver Program Can 
Pose Risks to U.S. 
Security, Law 
Enforcement, and 
Immigration Interests 



la GAO-03-38. 

20 GAO has issued a series of reports on how the visa issuance process serves as an 
antiterrorism tool, including: GAO, Border Security: Strengthened Visa Process Would 
Benefit from Improvements in Staffing and Information Sharing, GAO-05-859 
(Washington, D.C.: Sept. 13, 2005); Border Security: Actions Needed to Strengthen 
Management of Department of Homeland Security's Visa Security Program, GAO-05-801 
(Washington, D.C.: July 29, 2005); and, Border Security: Visa Process Should be 
Strengthened as an Antiterrorism Tool, GAO-03-132NI (Washington, D.C.: Oct. 21, 2002). 

21 A11 foreign visitors, whether they have visas or are seeking to enter the United States 
under the Visa Waiver Program, undergo inspections by CBP inspectors at U.S. air, sea, and 
land ports of entry to ensure that only admissible persons enter the United States. 
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inspector once they arrive at the U.S. port of entry, perhaps after having 
already boarded an international flight bound for the United States with a 
fraudulent travel document. For visa waiver travelers, CBP primary 
inspectors observe the applicant, examine his or her passport, collect the 
applicant's fingerprints as part of the U.S. Visitor and Immigrant Status 
Indicator Technology program (US- VISIT), 22 and check his or her name 
against automated databases and watch lists, which contain information 
regarding the admissibility of aliens, including known terrorists, criminals, 
and immigration law violators. However, according to the DHS OIG, 
primary border inspectors are disadvantaged when screening Visa Waiver 
Program travelers because they may not know the alien's language or local 
fraud trends in the alien's home country, nor have the time to conduct an 
extensive interview. In contrast, non-visa-waiver travelers, who must 
obtain a visa from a U.S. embassy or consulate, undergo an interview by 
consular officials overseas, who conduct a rigorous screening process 
when deciding to approve or deny a visa. As we have previously reported, 
State has taken a number of actions since 2002 to strengthen the visa 
issuance process as a border security tool. 23 Moreover, consular officers 
have more time to interview applicants and examine the authenticity of 
their passports, and may also speak the visa applicant's native language, 
according to consular officials. Inadmissible travelers who need visas to 
enter the United States may attempt to acquire a passport from a Visa 
Waiver Program country to avoid the visa screening process. 



22 The US-VISIT program is a government-wide program to collect, maintain, and share 
information on foreign nationals, and better control and monitor the entry, visa status, and 
exit of visitors. Under the program, foreign visitors are required to submit to fingerprint 
scans of their right and left index finger and have a digital photograph taken upon arrival at 
U.S. ports of entry. 

23 GAO-05-859 and GAO-03-132NI. 
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Figure 3: Comparison of Screening for U.S. Visas versus Arrival Inspection 
Screening at U.S. Air Ports of Entry 
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These screening steps occur for travelers 
with or without visas: 




Pre-arrival passenger screening 

• Airlines submit passenger information, including biographical data and passport numbers, to 
CBP prior to the arrival of the aircraft at a U.S. port of entry 

• CBP reviews the data and conducts queries against law enforcement and immigration 
databases, to determine whether any passengers are to be referred to secondary inspection 



Primary Inspection 

• Passport data scanned or entered manually into databases 

• Alien screened against watchlists 

• Establish identity of the alien and inspect documents for validity and authenticity 

• Identify inconsistencies between the database records and the documents presented; 

the aliens are sent to secondary inspections for more thorough examinations, if necessary 



Secondary Inspection 

• More in-depth, time-consuming analyses to verify the traveler's identity and documentation 

• Access to National Targeting Center, Forensic Document Laboratory, and other resources 



Traveler is admitted or denied entry 
into United States 



Sources: GAO; Nova Development (clip art). 



Lost and Stolen Passports from One of the Visa Waiver Program Oversight Unit's primary concerns is the 
Visa Waiver Program Countries potential exploitation by terrorists, immigration law violators, and other 
Are Highly Valued criminals of a visa waiver country's lost or stolen passports. DHS 
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intelligence analysts, law enforcement officials, and forensic document 
experts all acknowledge that misuse of lost and stolen passports is the 
greatest security problem posed by the Visa Waiver Program. Lost and 
stolen passports from visa waiver countries are highly prized travel 
documents, according to the Secretary General of Interpol. Moreover, Visa 
Waiver Program countries that do not consistently report the losses or 
thefts of their citizens' passports, or of blank passports, put the United 
States at greater risk of allowing inadmissible travelers to enter the 
country. 

Fraudulent passports from Visa Waiver Program countries have been used 
illegally by travelers seeking to disguise their true identities or 
nationalities when attempting to enter the United States. For example, 
from January through June 2005, DHS reported that it confiscated, at U.S. 
ports of entry, 298 fraudulent or altered passports issued by Visa Waiver 
Program countries that travelers were attempting to use for admission into 
the United States (see table l). 24 Two more recent cases demonstrate 
continued attempts to enter the United States with fraudulent passports 
issued by visa waiver countries: 

• In December 2005, a Pakistani citizen attempted to enter the United States 
under the program with a counterfeit United Kingdom passport that she 
had purchased. During secondary inspection, the CBP officer detected 
flaws in the passport. 

• In March 2006, an Albanian citizen attempted to enter the United States 
using a Belgian passport that he had purchased. The traveler confessed to 
this upon questioning by CBP officers during secondary inspection. 



24 In 2005, CBP established a Fraudulent Document Analysis Unit to conduct trend analyses 
on travel documents used to enter the United States. The unit's first statistical report 
covered fraudulent document trends from January through June 2005, primarily focusing 
on passport statistics. 
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Table 1 : Fraudulent Passport Intercepts, January through June 2005 


Visa Waiver Program country of issuance 


Number of passports 


France 




67 


Italy 




52 


United Kingdom 




38 


Japan 




29 


Singapore 




24 


Spain 




19 


Portugal 




19 


Slovenia 




14 


Netherlands 




9 


Germany 




6 


Austria 




5 


Belgium 




5 


Norway 




4 


Ireland 




3 


Sweden 




2 


Switzerland 




2 


Total 




298 



Source: CBP. 



In 2004, the DHS OIG reported that aliens applying for admission to the 
United States using lost or stolen passports have little reason to fear being 
caught. DHS's OIG reported that a lack of training hampered border 
inspectors' ability to detect passport fraud among Visa Waiver Program 
travelers, and recommended that CBP inspectors receive additional 
training in fraudulent document detection. 25 At that time, the 12-week 
training course for new inspectors at the Federal Law Enforcement 
Training Center devoted 1 day to passport fraud, according to the OIG. 
Currently, CBP dedicates 16 hours out of the 16-week basic training 
program to fraudulent document detection training for new border 
inspectors, and provides additional courses for inspectors throughout 
their assignments at ports of entry. Nevertheless, training officials said 
that fraudulent and counterfeit passports are extremely difficult to detect, 



25 GAO has also reported on inspections at land ports of entry. GAO, Land Border Ports of 
Entry: Vulnerabilities and Inefficiencies in the Inspections Process, GAO-03-1084R 
(Washington, D.C.: Aug. 18, 2003). 



Page 15 



GAO-06-854 Visa Waiver Program 



even for the most experienced border inspectors — which makes it 
imperative that lost and stolen passports are reported on a timely basis. 

Although DHS has intercepted some travelers with fraudulent passports at 
U.S. ports of entry, DHS officials acknowledged that an undetermined 
number of inadmissible aliens may have entered the United States using a 
lost or stolen passport from a visa waiver country. According to State, 
these aliens may have been inadmissible because they were immigration 
law violators, criminals, or terrorists. Following are several examples: 

• In July 2005, two aliens successfully entered the United States using lost or 
stolen Austrian passports. DHS was not notified that these passports had 
been lost or stolen prior to this date; the aliens were admitted, and there is 
no record of their departure, according to CBP. In October 2005, CBP 
referred this case to DHS Immigration and Customs Enforcement for 
further action. 

• In June 2005, CBP inspectors admitted into the United States two aliens 
using Italian passports that were from a batch of stolen passports. CBP 
was notified that this batch was stolen; however, the aliens altered the 
passport numbers to avoid detection by CBP officers. DHS has no record 
that these individuals departed the United States. 

• Also in June 2005, three aliens traveling together — all using fraudulent 
Italian passports — were interviewed at primary inspection. CBP referred 
one alien, an Albanian citizen, to secondary inspection because she was 
reluctant to answer the inspector's questions. In secondary inspection, 
CBP determined that her passport had been altered. CBP admitted the 
other two aliens, but subsequently determined that their passports were 
part of the batch of stolen Italian passports cited in the previous example. 



In July 2004, DHS created the Visa Waiver Program Oversight Unit within 
OIE to monitor the Visa Waiver Program. Its mission is to oversee Visa 
Waiver Program activities and monitor countries' adherence to the 
program's statutory requirements, ensuring that the United States is 
protected from those who wish to do it harm or violate its laws, including 
immigration laws. In 2004, DHS reviewed the law enforcement and 
security risks posed by the continued participation of 25 of the 27 
countries in the program. However, we identified problems with the 
country review process by which DHS assesses these risks. For example, 
DHS did not involve key interagency stakeholders in certain portions of 
the review process, and did not establish transparent protocols for the 



Process for Assessing 
Program Risks Has 
Weaknesses 
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country assessments — including internal milestones or deadlines for 
completing the final country assessments, the goals of the site visits, and 
an explanation of the clearance process. Furthermore, OIE is unable to 
effectively monitor the immigration, law enforcement, and security risks 
posed by visa waiver countries on a continuing basis because of 
insufficient resources. 



In April 2004, the DHS OIG identified significant areas where DHS needed 
to strengthen and improve its management of the Visa Waiver Program. 26 
For example, the OIG found that it was unclear who was managing the 
program following the dissolution of the Immigration and Naturalization 
Service. In addition, the OIG found that a lack of funding, trained 
personnel, and other issues left DHS unable to comply with the mandated 
biennial country assessments. In response to these findings, DHS 
established OIE's Visa Waiver Program Oversight Unit in July 2004, and 
named a director to manage the office. Since its establishment, DHS, and 
particularly OIE, has made strides to address concerns raised by the 2004 
OIG review. Specifically, DHS has: 

• conducted site visits in all 27 participating countries; 

• completed comprehensive assessments of 25 participating countries, 
examining the effect of continued participation in the Visa Waiver 
Program on U.S. security and law enforcement interests, including the 
enforcement of immigration laws; 

• identified risks in some of the countries and brought the concerns to the 
attention of host-country governments in five visa waiver countries; 27 

• submitted a six-page report to Congress in November 2005 that 
summarized the findings from the 2004 assessments; and 



Initial Steps Taken to 
Assess Risk of Visa Waiver 
Program 



Prior to the establishment of DHS in 2003, Justice's Office of the Inspector General 
examined visa waiver operations in 1999 and 2001, when the then-Immigration and 
Naturalization Service managed the program. Justice's Inspector General identified several 
chronic and recurring problems and made a series of recommendations to strengthen 
implementation of the program. 

27 In this report, we do not name the specific Visa Waiver Program countries where DHS 
identified security concerns because the department determined that this is sensitive 
information. 



Page 17 



GAO-06-854 Visa Waiver Program 



• initiated assessments for the remaining two countries in August and 
September 2005. 

In addition, in September 2005, DHS and State organized a technical 
conference in Washington, D.C., with representatives from Visa Waiver 
Program countries, to discuss the passport requirements for visa waiver 
travelers, and the October 2005 and 2006 deadlines for digital photographs 
and e-passports, respectively. Together, these actions demonstrate 
significant improvements since the April 2004 OIG report. 



DHS Lacks a Clearly- 
Defined, Consistent, and 
Timely Process to Assess 
Risks of Visa Waiver 
Program 



Despite these steps to strengthen and improve the management of the 
program, we identified several problems with the process DHS uses to 
assess the risks posed by each of the visa waiver countries' continued 
participation in the program — namely the mandated biennial country 
assessment process. For the 2004 assessments, we found the following: 

• some key stakeholders were excluded from the decision-making process; 

• the reviews lacked clear criteria to make key judgments; 

• there was inconsistent preparation for the in-country site visits for the 
reviews; and 

• DHS and its interagency partners neither completed the 25 country 
assessments nor issued the summary report to Congress in a timely 
manner. 



Review Process Did Not 
Involve Key Stakeholders 



OIE has acknowledged such weaknesses and has begun to make 
adjustments; however, concerns remain. 

We found that the review process lacked clear protocols, as key 
stakeholders were left out of the report development process. Specifically, 
after conducting the site visits and contributing to the reports on the site 
visits, DHS and the interagency working group did not seek input from all 
site visit team members while drafting and clearing the final country 
assessments and subsequent report to Congress. For example, DHS's 
forensic document analysts, who participated in the site visits in 2004, told 
us that they did not see, clear, or comment on the draft country 
assessments, despite repeated attempts to obtain copies of them. Thus, 
these analysts questioned the integrity of the process because they had not 
seen how their analyses were incorporated into the final assessments. 
Additionally, State's headquarters officers who cover diplomatic relations 
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in Visa Waiver Program countries, as well as embassy officials in all of the 
posts we visited, stated that they were not asked to review or provide 
comments on the draft assessments, nor had they seen the final 
assessments. CBP officials also stated that they repeatedly requested 
copies of the country assessments and subsequent report to Congress, but 
did not receive them. According to State's Bureau of Consular Affairs, DHS 
did not seek feedback from U.S. embassies and State's regional bureaus on 
the draft site visit or individual country assessments. Because these 
assessments contained classified information, OIE officials told us that 
they were not broadly distributed in draft or final form. Nevertheless, 
without this information, key stakeholders could not be effective 
advocates for U.S. concerns. 

Review Process Lacked Clear We found that DHS did not have clear criteria when assessing each 
Criteria to Make Key country's participation in the program to determine at what point security 

Judgments concerns would trigger discussions with foreign governments about these 

concerns and an attempt to resolve them. As previously mentioned, the 
DHS-led interagency working group identified five countries from its 2004 
assessment with significant security concerns, and DHS, in coordination 
with State, discussed these concerns with government officials. 
Furthermore, U.S. embassies issued a formal diplomatic demarche to the 
five governments regarding the concerns in March 2005. 28 However, while 
the working group also had concerns with a sixth country, it decided not 
to issue a demarche to this government. According to State, the working 
group determined that the concerns identified in this country were not 
directly related to the Visa Waiver Program and the country's participation 
in the program. However, OIE officials and other working group members 
stated that they did not use any standard criteria in making this 
determination. State officials agreed that qualitative and/or quantitative 
criteria would be useful when making these determinations, although DHS 
stated that the criteria should be flexible. During our visit to the U.S. 
embassy in the sixth country, which was not issued a demarche, U.S. 
officials told us they were unaware that the working group had discussed 
security concerns in the context of the country assessment. While 
embassy officials had already been addressing these issues as part of their 
mission, they said that they would have likely seen greater progress made 



28 In coordination with DHS, U.S. embassy officials communicated these concerns through 
an official demarche to each government. A demarche presents a formal U.S. government 
position or request to a foreign government. Demarches are generally presented in writing, 
but can also be transmitted orally. According to diplomatic protocol, a demarche requires 
an official, formal response from the other government. 
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in discussions with foreign government officials if all parties had known 
that there was a potential link between these security concerns and visa 
waiver requirements. 

Inconsistent Preparation for The site visits associated with each country review were not always well- 
Site Visits prepared and lacked a consistent approach, according to the site visit 

team members. Several team members representing different agencies 
stated that they did not receive adequate information and guidance prior 
to conducting the site visits and, thus, were not well-prepared to conduct 
the visits. DHS did not brief or train the site visit team members prior to 
conducting the 2004 reviews, and many said that the goals of the in- 
country visits were not clear. One team member stated that the site visits 
were largely "fact-finding trips," as opposed to a targeted analysis of law 
enforcement and security concerns. Moreover, prior to conducting the site 
visits, DHS sent each country a background questionnaire; however, OIE 
and team members stated that some countries did not provide responses 
to the questionnaire prior to the site visit, which would have been useful 
for preparation. Furthermore, senior U.S. officials in each of the embassies 
we visited stated that the goals and priorities of the 2004 DHS-led site visit 
teams were not clear to them. Consular officials at half of the posts we 
visited also said that the site visit teams arrived on short notice and did not 
give them adequate time to prepare. As a result, the teams may not have 
made the most efficient use of their time in-country, and may not have 
gathered their information on a consistent basis. 

Reporting Untimely DHS did not issue, in a timely manner, the summary report to Congress 

that generally described the overall findings from the 25 country 
assessments. Although DHS is mandated to conduct the country 
assessments every 2 years, Congress did not establish a deadline by which 
the assessments must be completed or the summary report issued. OIE, 
State, and Justice officials acknowledged that the assessments took too 
long to complete. The interagency teams conducted site visits as part of 
the country assessments from May through September 2004, and 
transmitted the final summary report to Congress more than 1 year later, 
in November 2005. The report to Congress was a six-page summary that 
did not include detailed descriptions of the law enforcement and security 
risks identified during the review process, which were discussed at length 
in the individual country assessments. According to interagency working 
group members, DHS did not establish internal milestones or deadlines for 
completing the final country assessments. OIE officials attributed the 
lengthiness of the assessment process to the multiple rounds of clearances 
for each of the 25 assessments and the summary report. 
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While the country assessments were awaiting clearance, there were 
missed opportunities to capture more recent developments, and the final 
assessments contained dated information or were incomplete. For 
example, in May 2005, a post in one visa waiver country was notified there 
had been a large-scale, high-profile theft of blank passports. While the U.S. 
government was aware of this theft, this information was not captured in 
that country's assessment as it was being cleared. Moreover, the teams 
collecting information about the visa waiver countries' risks in 2004 used, 
in some cases, information from 2 years prior; by the time the summary 
report was issued in November 2005, some of the data was over 3 years 
old. As a result of this lengthy process, the final report presented to 
Congress did not necessarily reflect the current law enforcement and 
security risks posed by each country, or the positive steps that countries 
had made to address these risks (see fig. 4). 
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Figure 4: Timeline of 2004-2005 Country Assessment Process and Other Key Milestones 



July 2004 - 

Visa Waiver Program 
Oversight Unit established 
within OIE 



August/September 2005 - 

DHS-led teams conducted 
two remaining country site 
visits 



March 2004 - 

Interagency working 
group began gathering 
information for 2004 
assessments 



March 2005 - 

Demarches issued to five 
countries of concern 




November 2005 - 

Summary report of 
2004 reviews 
issued to Congress 



December 2004 - 

OIG reported on vulnerabilities 
of stolen passports from visa 
waiver countries 



jrce: GAO. 



May-September 2004 - 

DHS-led teams conducted 
25 of 27 country site visits 



Despite Adjustments to OIE officials acknowledged weaknesses in the 2004 reviews, and made 

Process, Weaknesses Remain some adjustments for the 2005 country assessments for Italy and Portugal, 

the two remaining countries. For the 2005 reviews, DHS conducted a 1-day 
training seminar to explain the objectives of the visit and share 
information about the countries to the site visit teams, including findings 
from prior country assessments. Additionally, the team members met prior 
to conducting the site visits, and reconvened upon returning to 
Washington, D.C., to ensure consensus on their report on the site visit. 
However, the 2005 country review process still lacked consistency and 
transparency. In particular, DHS has not finalized its operating procedures 
for site visits. The site visit teams traveled to the remaining two countries 
in August and September 2005; however, as of June 2006, DHS had neither 
updated the interagency working group team members on the status of the 
reviews of Italy and Portugal, nor provided them with a timeline for 



Page 22 



GAO-06-854 Visa Waiver Program 



proceeding with the review. Furthermore, stakeholders continued to 
express concern about DHS's lack of communication about the process 
and the findings, and no changes have been made to the review process 
that would make the final report to Congress timely. Therefore, there are 
no assurances that the next biennial assessment round will proceed more 
quickly than the previous round. 



DHS Cannot Effectively 
Monitor Ongoing Concerns 
in Visa Waiver Countries 



DHS cannot effectively monitor the law enforcement and security risks 
posed by visa waiver countries on a consistent, ongoing basis because it 
has not provided OIE with adequate staffing and resources. Furthermore, 
we found weaknesses in communication between DHS and overseas posts 
and other agencies. 



Lack of Staffing and Funding OIE is limited in its ability to achieve its mission because of insufficient 
Impedes Ability to Assess Risks staffing and funding. The office has numerous responsibilities, including 

• conducting the mandated biennial country reviews; 

• monitoring law enforcement, security, and immigration concerns in visa 
waiver countries on an ongoing basis; 

• working with countries seeking to become members of the Visa Waiver 
Program; 29 and 

• briefing foreign government representatives from participating visa waiver 
countries, as well as those countries that are seeking admission into the 
program, on issues related to program membership. 

In 2004, the DHS OIG found that OIE's lack of resources directly undercut 
its ability to assess a security problem inherent in the program — lost and 
stolen passports. The office received funding to conduct the country 
reviews in 2004 and 2005; however, OIE officials indicated that a lack of 
funding and full-time staff has made it extremely difficult to conduct 
additional overseas fieldwork, as well as track ongoing issues of concern 
in the 27 visa waiver countries — a key limitation in DHS's ability to assess 
and mitigate the program's risks. According to OIE officials, the unit 
developed a strategic plan to monitor the program, but has been unable to 



See G AO, Process for Admitting Additional Countries into the Visa Waiver Program, 
GAO-06-835R (Washington, D.C.: July 28, 2006). 
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implement its plan with its current staffing. As of June 2006, the office was 
staffed with two full-time employees, as well as one temporary employee 
from another DHS component. Moreover, OIE does not have a separate 
budget, but must request funds (for example, to conduct travel related to 
the Visa Waiver Program) from the Office of Policy Development. In 
addition, program officials stated that they have paid for their own office 
supplies using their personal savings due to funding constraints. Without 
adequate resources, OIE is unable to monitor and assess participating 
countries' compliance with the Visa Waiver Program's statutory 
requirements. 

Gaps in DHS's Communications DHS has not clearly communicated its mission to stakeholders at overseas 
with its Overseas Posts and posts, nor identified points of contact within U.S. embassies, so it can 

Other Agencies communicate directly with field officials positioned to monitor countries' 

compliance with Visa Waiver Program requirements and report on current 
events and issues of potential concern. In particular, within DHS's various 
components, we found that OIE is largely an unknown entity and, 
therefore, is unable to leverage the expertise of DHS officials overseas. 
Specifically, only 3 of the 15 DHS field officials with whom we spoke in the 
six visa waiver countries we visited were aware of the Visa Waiver 
Program Oversight Unit and its mission. A senior DHS representative at 
one post showed us that her organizational directory did not contain 
contact information for OIE. In addition, an official from the Immigration 
and Customs Enforcement's Office of International Affairs acknowledged 
that DHS needs a better communication plan for the Visa Waiver Program. 
He stated that DHS had not prioritized the workload for all its officials 
overseas, including their role in overseeing the Visa Waiver Program; he 
also told us that OIE had not yet articulated what information it needed, 
designated a mechanism to share that information, or gained agency-wide 
acceptance of procedures for monitoring the compliance of visa waiver 
countries. In fact, a senior DHS official in Washington, D.C., told us that he 
may find out about developments — either routine or emergent — in visa 
waiver countries by "happenstance." Without an outreach strategy, DHS is 
not able to leverage its existing resources at U.S. embassies in all visa 
waiver countries. 

Furthermore, key stakeholders, who are in a position to influence and 
monitor visa waiver countries' compliance with the program's 
requirements, were not informed of the major findings of the country 
assessments. In fact, at the time of our visits, ambassadors or deputy 
chiefs of mission in each of the six posts told us that they were not fully 
aware of the extent to which the country assessments discussed law 
enforcement and security concerns posed by the continued participation 
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of the country in the program. The Deputy Chief of Mission at one post 
stated that without the appropriate information, such as was contained in 
the assessments, embassy officials could not be effective agents for the 
U.S. government with regard to these issues. Bureau of Consular Affairs 
officials in Washington, D.C., agreed that any concerns identified in the 
assessments should be brought to the attention of the embassy, so that the 
posts can address the concerns accordingly. Due to the lack of outreach 
and clear communication about its mission, OIE is limited in its ability to 
monitor the day-to-day law enforcement and security concerns posed by 
the Visa Waiver Program, and the U.S. government is limited in its ability 
to influence visa waiver countries' progress in meeting requirements. 

We also found gaps in interagency communication. According to OIE, 
State plays a significant role in conveying information relevant to the Visa 
Waiver Program to U.S. embassy officials and their host government 
counterparts. Therefore, it is important that State and DHS have clear lines 
of communication. For example, in October 2005, one government 
expressed willingness to share data on lost and stolen issued passports 
with the United States, and asked for technical specifications on how to do 
so. However, at the time of our February 2006 visit, the post in that 
country had not received direction from headquarters on how this 
passport information should be shared. Moreover, OIE officials told us 
that they were unaware that this country was willing to share this data 
until we brought it to their attention in early March 2006. As a result, the 
United States missed opportunities to potentially deter the fraudulent use 
of passports from this country, which in fact has the highest rate of misuse 
among all visa waiver countries, according to DHS. Additionally, a senior 
consular official in another participating country expressed frustration 
that DHS had not fully explained to embassy officials why visa waiver 
countries needed to report lost and stolen passport information directly to 
the United States and Interpol, which maintains a global database of lost 
and stolen travel documents. Several other senior consular officials also 
expressed the need for more information about OIE's mission and goals, 
as well as the desired role for overseas posts. 



DHS has taken some actions to mitigate the risks of the Visa Waiver 
Program, such as terminating the use of the German temporary passport 
for travel under the program. Since 2002, the law has required the timely 
reporting of passport thefts for continued participating in the Visa Waiver 
Program, but DHS has not established and communicated time frames and 
operating procedures to participating countries. In addition, DHS has 
sought to expand this requirement to include the reporting of data, to the 



DHS Faces 
Difficulties in 
Mitigating Program 
Risks 
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United States and Interpol, on lost and stolen issued passports; however, 
participating countries are resisting these requirements, and DHS has not 
yet issued guidance on what information must be shared, with whom, and 
within what time frame. Furthermore, U.S. border inspectors are unable to 
automatically access Interpol's data on reported lost and stolen passports, 
which makes it more difficult to detect reported lost or stolen passports at 
U.S. ports of entry. 



DHS Has Taken Some 
Actions to Mitigate Risks 
of the Visa Waiver Program 



As previously mentioned, during the 2004 assessment process, the working 
group identified security concerns in several participating countries, and 
DHS took actions to mitigate some of these risks. For example, DHS 
determined that several thousand blank German temporary passports 30 had 
been lost or stolen, and that Germany had not reported some of this 
information to the United States. In March 2005, at the working group's 
request, the U.S. embassy in Berlin conveyed these concerns to the 
German government to seek a solution. In March 2006, DHS determined 
that sufficient progress had not been made to address the concern over 
German temporary passports, and, as of May 1, 2006, German temporary 
passport holders are not allowed to travel to the United States under the 
Visa Waiver Program without a visa. 

DHS has also made some progress in enforcing new passport security 
measures. For example, DHS has enforced an October 26, 2005, deadline 
requiring travelers under the Visa Waiver Program to have digital 
photographs in their passports. Specifically, Italian and French citizens 
with noncompliant passports issued after October 26, 2005, must first 
obtain a visa before traveling to the United States because these countries 
did not meet the deadline. Furthermore, as previously mentioned, by 
October 26, 2006, visa waiver travelers must have e-passports for travel 
under the program. E-passports aim to enhance the security of travel 
documents, making it more difficult for imposters or inadmissible aliens to 
misuse the passport to gain entry into the United States. DHS and State 
officials told us that nearly all 27 participating countries report that they 
are on schedule to meet this deadline. 31 According to US- VISIT, DHS will 



German temporary passports are valid for one year, and are less expensive than standard 
German passports. In addition, they are issued at more than 6,000 locations across 
Germany, whereas the Ministry of Interior issues the standard passports centrally. 

31 According to a US-VISIT official, as of June 2006, it had verified e-passports from 12 of 27 
visa waiver countries. 
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deploy machines to read the e-passports at 33 airports by the October 2006 
deadline, covering about 98 percent of all visa waiver travelers. While US- 
VISIT intends to deploy e-passport readers to all ports of entry in the 
future, it has not articulated clear timeframes to do so. 32 Therefore, until 
this is achieved, it will not be possible for DHS to read the information on 
the chips embedded in the passports for the remaining ports of entry. 



DHS Lacks Standard 
Procedures for Obtaining 
Stolen Blank Passport 
Data 



A key risk in the Visa Waiver Program is stolen blank passports from visa 
waiver countries, because detecting these passports at U.S. ports of entry 
is extremely difficult, according to DHS. Some thefts of blank passports 
have not been reported to the United States until years after the fact, 
according to DHS intelligence reports. For example, in 2004, a visa waiver 
country reported the theft of nearly 300 stolen blank passports to the 
United States — more than 9 years after the theft occurred. In addition, in 
2004, a visa waiver country reported the theft of 270 blank passports more 
than 8 months after the theft occurred. The 2002 Enhanced Security and 
Visa Entry Reform Act provides that the Secretary of Homeland Security 
must terminate a country from the Visa Waiver Program if he and the 
Secretary of State jointly determine that the country is not reporting the 
theft of its blank passports to the United States on a timely basis. DHS and 
State have chosen not to terminate from the program countries that have 
failed to report these incidents. 



DHS officials told us that the inherent political, economic, and diplomatic 
implications associated with removing a country from the Visa Waiver 
Program make it difficult to enforce the statutory requirement in the 
broadest terms. Moreover, DHS has not established time frames or 
operating procedures to enforce this requirement. In April 2004, the DHS 
OIG recommended that the then-Under Secretary for Border and 
Transportation Security, in coordination with State, develop standard 
operating procedures for the routine and proactive collection of stolen 



In May 2006, a US-VISIT official stated that DHS had not yet decided from which company 
the department would procure the e-passport readers. DHS still needs to decide how it will 
use the digital image from the e-passport, including whether the image will be displayed on 
the US-VISIT screen during inspection, and if so, whether it will be displayed in place of or 
in addition to the photo already stored in US-VISIT. Furthermore, countries have the option 
to store other biometric information, such as fingerprints or iris images, on the chip, and 
DHS will need to make decisions about whether it will use such information, if available, 
during inspections. According to US-VISIT, it will deploy e-passport readers to the 
remaining ports of entry at a future date to take advantage of anticipated improved reader 
technology, while minimizing procurement and training costs. 
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passport information from host governments for dissemination to U.S. 
agencies. While the statute requires visa waiver countries to certify that 
they report information on the theft of their blank passports to the United 
States on a timely basis, as of June 2006, DHS has not defined what 
constitutes "timely." Moreover, the United States lacks a centralized 
mechanism for foreign governments to report all stolen passports. In 
particular, DHS has not defined to whom in the U.S. government 
participating countries should report this information. 



Some Participating Visa 
Waiver Program Countries 
Are Resisting Additional 
Reporting to United States 
and Interpol 



In addition to blank passports, lost or stolen issued passports also pose a 
risk because they can be altered. In June 2005, DHS issued guidance to 
participating Visa Waiver Program countries requiring that they certify 
their intent to report lost and stolen passport data on issued passports by 
August 2005. However, DHS has not yet issued guidance on what 
information must be shared, with whom, and within what time frame. 
Some visa waiver countries have not yet agreed to provide this 
information to the United States, due in part to concerns over the privacy 
of their citizens' biographical information. In addition, several consular 
officials expressed confusion about the current and impending 
requirements about sharing this data, and felt they were unable to 
adequately explain the requirements to their foreign counterparts. 

In June 2005, the U.S. government also announced its intention to require 
visa waiver countries to certify their intent to report information on both 
lost and stolen blank and issued passports to Interpol. In 2002, Interpol 
developed a database of lost and stolen travel documents to which its 
member countries may contribute on a voluntary basis. The United States 
has endorsed Interpol's database, and, since May 2004, State has been 
contributing U.S. data from lost and stolen blank passports to it. In 2005, 
State reported to Congress that it also instructed all U.S. embassies and 
consulates to take every opportunity to persuade host governments to 
share this data with Interpol. While most visa waiver countries use and 
contribute to Interpol's database, four do not. Moreover, some countries 
that do contribute do not do so on a regular basis, according to Interpol 
officials. Interpol stated that it continues to encourage countries to send 
this information more systematically. In addition, participating countries 
have expressed concerns about reporting this information, citing privacy 
issues; however, Interpol's database on lost and stolen travel documents 
does not include the passport bearers' biographical information, such as 
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name and date of birth. 33 According to the Secretary General of Interpol, in 
light of the high value associated with passports from visa waiver 
countries, it is a priority for his agency to encourage these countries to 
contribute to the database. 



Inefficient Access to 
Interpol's Database on Lost 
and Stolen Passports 



Though information from Interpol's database could potentially stop 
inadmissible travelers from entering the United States, CBP's border 
inspectors do not have automatic access to the database at primary 
inspection at U.S. ports of entry — the first line of defense against those 
who might exploit the Visa Waiver Program to enter the United States. The 
inspection process at U.S. ports of entry can include two stages — a 
primary and secondary inspection. If, during the primary inspection, the 
inspector suspects that the traveler is inadmissible either because of a 
fraudulent passport or other reason, the inspector refers the traveler to 
secondary inspection. At secondary inspection, border inspectors can 
contact officials at the National Targeting Center, who can query Interpol's 
stolen-travel-document database to determine if the traveler is attempting 
to enter the United States with a passport that had been previously 
reported lost or stolen, but is not yet on CBP's watch list (see fig. 5). 34 
However, Interpol's data on lost and stolen travel documents is not 
automatically accessible to border inspectors at primary inspection — one 
reason why it is not currently an effective border screening tool, according 
to DHS, State, and Justice officials. According to the Secretary General of 
Interpol, until DHS can automatically query Interpol's data, the United 
States will not have an effective screening tool for checking passports. 



33 Interpol's database includes the passport's identity number, the country of issuance, and 
the country where the loss or theft occurred. According to officials from Justice's Interpol- 
U.S. National Central Bureau, it is particularly important that countries report this 
information, as well as the date of the theft and the issuance date. 

34 Interpol's data on lost and stolen passports are not available when border inspectors 
screen travelers against US-VISIT or the Treasury Enforcement Communications System 
(TECS), unless Interpol has shared this information with the United States in separate 
reports and it has been manually entered into TECS by DHS. TECS maintains watch list 
data, interfaces with other agencies' databases, and is used by inspectors at ports of entry 
to verify traveler information and update traveler data. TECS's watch list data sources 
include DHS' CBP and Immigration and Customs Enforcement; the Federal Bureau of 
Investigation (FBI); State; and the Drug Enforcement Agency, among others. 
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Figure 5: CBP's Access to Interpol's Lost and Stolen Travel Document Database 



Current process 



Interpol available at secondary inspection 






Primary inspection 

Inspectors do not have access to Interpol's database 



Secondary inspection 

Inspectors can request a query of Interpol's database 



Proposed process / Interpol automatically accessed at primary inspection 




Primary inspection 

Inspectors have automatic access to Interpol database 



Secondary inspection 

Interpol database utilized at primary inspection 



Sources: GAO (data and photos); Nova Development (clip art). 
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According to Interpol officials, the United States is working actively with 
Interpol on a potential pilot project that would allow for an automatic 
query of aliens' passport data against Interpol's database at primary 
inspection at U.S. ports of entry. However, DHS has not yet finalized a plan 
to do so. In December 2005, Interpol began a similar program at all border 
stations in Switzerland. Through this program, Swiss border agents query 
Interpol's database as soon as travelers appear at a border station. 
According to the Secretary General of Interpol, in a 2-month period, 
Switzerland encountered 282 potential instances of travelers attempting to 
enter the country with a previously reported lost or stolen passport. In 
addition, during this time frame, Swiss border agents queried Interpol's 
database more than all other member countries combined because it was 
the only country accessing the database automatically. 

In commenting on a draft of this report, Justice's Interpol-U.S. National 
Central Bureau stated that from April through June 2006, Justice, CBP's 
National Targeting Center, and Interpol compared records from certain 
passengers arriving in the United States against Interpol's lost and stolen 
travel document database. According to the National Central Bureau, the 
test's objectives were to simulate an automatic query of passenger records 
against Interpol's database and analyze discrepancies between that 
database and U.S. watch lists. The National Central Bureau stated that, by 
early August 2006, it and the National Targeting Center will finalize a 
report on this test to help facilitate a pilot program for real-time, 
systematic queries of passenger records against Interpol's data at U.S. 
ports of entry. 



The Visa Waiver Program aims to facilitate international travel for millions 
of people each year and promote the effective use of government 
resources. Effective oversight of the program entails balancing these 
benefits against the program's potential risks. To find this balance, the U.S. 
government needs to fully identify the vulnerabilities posed by visa waiver 
travelers, and be in a position to mitigate them. However, we found 
weaknesses in the process by which the U.S. government assesses these 
risks, and DHS's Visa Waiver Program Oversight Unit is not able to manage 
the program with its current resource levels. Moreover, DHS has not 
communicated clear reporting requirements for lost and stolen 
passports — a key risk — nor can it automatically access all stolen passport 
information when it is most needed — namely, at the primary inspection 
point at U.S. points of entry. It is imperative that DHS commit to 
strengthen its ability to promptly identify and mitigate risks to ensure that 
the Visa Waiver Program does not jeopardize U.S. security interests. 
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To improve the U.S. government's process for assessing risks in the Visa 
Waiver Program, we recommend that the Secretary of Homeland Security, 
in coordination with State and other appropriate agencies, take the 
following five actions: 

Provide additional resources to strengthen OIE's visa waiver monitoring 
unit. 

Finalize clear, consistent, and transparent protocols for the biennial 
country assessments and provide these protocols to stakeholders at 
relevant agencies at headquarters and overseas. These protocols should 
provide timelines for the entire assessment process, including the role of a 
site visit, an explanation of the clearance process, and deadlines for 
completion. 

Create real-time monitoring arrangements, including the identification of 
visa- waiver points of contact at U.S. embassies, for all 27 participating 
countries; and establish protocols, in coordination with appropriate 
headquarters offices, for direct communication between points of contact 
at overseas posts and OIE's Visa Waiver Program Oversight Unit. 

Require periodic updates from points of contact at posts in countries 
where there are law enforcement or security concerns relevant to the Visa 
Waiver Program. 

Provide complete copies of the most recent country assessments to 
relevant stakeholders in headquarters and overseas posts. 

To improve the U.S. government's process for mitigating the risks in the 
Visa Waiver Program, we recommend that the Secretary of Homeland 
Security, in coordination with State and other appropriate agencies, take 
the following three actions: 

Require that all visa waiver countries provide the United States and 
Interpol with non-biographical data from lost or stolen issued passports, 
as well as from blank passports. 

Develop and communicate clear standard operating procedures for the 
reporting of lost and stolen blank and issued passport data, including a 
definition of timely reporting and to whom in the U.S. government 
countries should report. 



Page 32 



GAO-06-854 Visa Waiver Program 



• Develop and implement a plan to make Interpol's stolen travel document 
database automatically available during primary inspection at U.S. ports of 
entry. 



Matter for 

Congressional 

Consideration 



The May 2002 Enhanced Border Security and Visa Entry Reform Act 
mandated DHS to conduct country assessments of the effect on U.S. law 
enforcement and security interests of each country's continued 
participation in the Visa Waiver Program at least every 2 years. Given the 
lengthy time it took for DHS to issue the November 2005 summary report 
to Congress, and to ensure future reports contain timely information when 
issued, Congress should consider establishing a biennial deadline by 
which DHS must complete the country assessments and report to 
Congress. 



Agency Comments 
and Our Evaluation 



DHS, State, and Interpol provided written comments on a draft of this 
report (see apps. IV, V, and VI). DHS, State, Interpol, and Justice's Interpol- 
U.S. National Central Bureau provided technical comments, which we 
incorporated into the report, as appropriate. 



DHS either agreed with, or stated that it is considering, all of our 
recommendations. Regarding our matter for congressional consideration, 
DHS did not appear to support the establishment of a deadline for the 
biennial report to Congress. Instead, DHS suggested that Congress should 
require continuous and ongoing evaluation. With continuous review, DHS 
stated that it would be able to constantly evaluate U.S. interests and report 
to Congress on the current 2-year reporting cycle on targeted issues of 
concern, rather than providing a historical evaluation. We agree that 
continuous and ongoing evaluation is necessary, and that is why we 
recommended that DHS create real-time monitoring arrangements and 
provide additional resources to the Visa Waiver Program Oversight Unit to 
achieve this goal. Regarding the mandated biennial country assessments, 
we believe that they can serve a useful purpose if they are completed in a 
timely fashion. In addition, DHS provided information on actions that it 
has taken to improve the management of the biennial country assessment 
process. 



State agreed that efforts by U.S. embassies and consulates to monitor and 
assess the Visa Waiver Program would benefit from enhanced 
communication to and from DHS, and endorsed our recommendation that 
DHS provide more information to these stakeholders on Visa Waiver 
Program issues. In addition, State acknowledged the risk of misuse of 
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previously lost or stolen passports, particularly by persons who are not 
eligible for a visa. With regard to timely reporting on lost and stolen 
passports, State welcomed our recommendation calling for clear 
guidelines and reporting mechanisms to achieve this goal. 

Interpol provided information about its lost and stolen travel document 
database and tools that it has developed to allow law enforcement officers 
to instantly check this database at airports and other border entry points. 
In addition, Interpol noted that many developing countries lack the 
resources necessary to implement these tools. Therefore, Interpol urged 
the United States and other countries to provide funding to facilitate 
access for all countries to its lost and stolen travel document database. It 
also provided its views on the risks associated with lost and stolen 
passports. 



As agreed with your office, unless you publicly announce the contents of 
this report earlier, we plan no further distribution until 30 days from the 
report date. At that time, we will provide copies of this report to the 
Secretaries of State and Homeland Security, as well as the Attorney 
General and the Secretary General of Interpol. We will also make copies 
available to others upon request. 
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In addition, this report will be available at no charge on the GAO Web site 
at http://www.gao.gov. If you or your staff have any questions about this 
report, please contact me at (202) 512-4128 or fordj@gao.gov. Contact 
points for our Offices of Congressional Relations and Public Affairs may 
be found on the last page of this report. GAO staff who made major 
contributions to this report are listed in appendix VII. 

Sincerely yours, 




Jess T. Ford 

Director, International Affairs and Trade 
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Appendix I: Scope and Methodology 



To describe the benefits of the Visa Waiver Program, we reviewed relevant 
documentation, including Office of Inspector General (OIG) reports and 
our 2002 report on the implications of eliminating the program. 1 We also 
interviewed political, economic, consular, commercial, and law 
enforcement officials at U.S. embassies overseas to discuss the advantages 
of the program for U.S. business and tourism. To describe the risks in the 
Visa Waiver Program, we examined documentation on the screening 
process at U.S. ports of entry for travelers from Visa Waiver Program 
countries. In addition, we analyzed data from Customs and Border 
Protection (CBP) on interceptions of fraudulent, lost, or stolen passports 
from participating countries. We also observed fraudulent document 
detection training of CBP agents at the Federal Law Enforcement Training 
Center and spoke with training officials regarding the difficulty in 
detecting fraudulent passports. We also interviewed officials from the 
Department of Homeland Security's (DHS) National Targeting Center, 
Intelligence and Analysis Directorate, and Forensic Document Laboratory 
on the risks posed by Visa Waiver Program travelers. 

In particular, we analyzed data on the number of nonimmigrants that 
entered the United States under the Visa Waiver Program from fiscal years 
2002 though 2004. While we did not fully assess the reliability of these 
statistics because we used them for background purposes, we conducted 
interviews and obtained other corroborating evidence that confirmed the 
importance of the Visa Waiver Program in terms of the broad numbers of 
admissions to the United States in recent years. 

Regarding DHS's data on fraudulent passports, DHS reported that these 
data are limited to those cases in which the fraudulent document from the 
Visa Waiver Program country was intercepted at a port of entry, and do 
not include instances when fraudulent passports were used to enter the 
United States but were not detected. While we could not fully assess the 
reliability of the data, we found them sufficiently reliable to establish that 
hundreds of fraudulent documents from a broad range of Visa Waiver 
Program countries were intercepted in 2005. In addition, the number of 
documents that DHS reports by country is not necessarily indicative of the 
extent of the problem in that country, as these data only cover instances 
when fraudulent documents were intercepted. 



^ee GAO, Border Security: Implications of Eliminating the Visa Waiver Program, 
GAO-03-38 (Washington, D.C., Nov. 22, 2002). 
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To evaluate the U.S. government's efforts to assess and mitigate these 
risks, we analyzed the laws governing the program, relevant agency 
operating procedures, and DHS OIG reports. We also examined 15 of the 
25 completed reports assessing the participation of Visa Waiver Program 
countries. 2 As of June 2006, the remaining 10 assessments were pending 
classification review by DHS's Office of International Enforcement. These 
assessments contained, among other things, detailed analyses of an 
individual country's 

• political, social, and economic conditions; 

• security over its passport and national identity documents; 

• border controls; 

• immigration and nationality laws, law enforcement policies and practices, 
and other matters relevant to law enforcement, immigration, and national 
security; 

• patterns of passport fraud, visa fraud, and visa abuse; 

• assessments of terrorism, by the country's nationals, within or outside the 
country, and; 

• evaluations of the impact of the country's participation in the Visa Waiver 
Program on U.S. national security and law enforcement. 

To discuss these assessments and actions taken in response to their 
findings, we met with officials from several DHS component agencies and 
offices, the Department of State's Bureau of Consular Affairs and its 
Europe and Eurasia Bureau, and the International Criminal Police 
Organization (Interpol) in Lyon, France. In addition, we met with officials 
from the Department of Justice's U.S. National Central Bureau in 
Washington, D.C., which facilitates international law enforcement 
cooperation among the United States and Interpol and its other member 
countries. We also spoke with U.S. Embassy officials in six Visa Waiver 
Program countries, as well as foreign government officials in three of 
these countries. During these visits, we observed visa operations and 
interviewed embassy management, consular staff, and representatives 



2 As of June 2006, the reviews of the remaining two participating countries — Italy and 
Portugal — were in process. 
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from law enforcement agencies regarding their roles and responsibilities 
in overseeing the Visa Waiver Program. 

We conducted our evaluation from September 2005 through June 2006 in 
accordance with generally accepted government auditing standards. 



Page 38 



GAO-06-854 Visa Waiver Program 



Appendix II: Map of Visa Waiver Program 
Countries 




Sources: GAO; MapArt (image). 
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Appendix III: Foreign Nationals Admitted 
under the Visa Waiver Program, Fiscal Years 
2002 through 2004 



Fiscal year 



Country of citizenship 


2002 


2003 


2004 


Andorra 


386 


478 


654 


Australia 


445,242 


484,086 


577,161 


Austria 


107,636 


115,164 


136,050 


Belgium 


166,286 


155,693 


185,836 


Brunei 


303 


323 


404 


Denmark 


124,819 


141,880 


165,190 


Finland 


71 ,338 


73,585 


89,190 


France 


932,847 


920,774 


1,121,824 


Germany 


1,208,121 


1 ,254,490 


1,446,806 


Iceland 


17,733 


19,810 


26,727 


Ireland 


297,496 


328,769 


392,938 


Italy 


515,126 


576,346 


693,628 


Japan 


3,347,900 


3,303,878 


4,044,284 


Liechtenstein 


996 


995 


1,182 


Luxembourg 


6,001 


6,447 


7,287 


Monaco 


377 


432 


614 


Netherlands 


486,672 


498,528 


560,403 


New Zealand 


187,235 


180,572 


202,904 


Norway 


110,713 


119,846 


140,015 


Portugal 


57,245 


64,330 


82,089 


San Marino 


279 


300 


375 


Singapore 


49,713 


54,539 


71,579 


Slovenia 


6,951 


9,703 


1 1 ,643 


Spain 


350,044 


375,021 


487,715 


Sweden 


198,532 


220,577 


273,007 


Switzerland 


228,298 


221,757 


244,921 


United Kingdom 


3,938,842 


4,189,906 


4,639,055 


Total 


12,857,131 


13,318,229 


15,603,400 



Source: CBP. 
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Appendix IV: Comments from the 
Department of Homeland Security 



Note: GAO comments 
supplementing those in 
the report text appear at 
the end of this appendix. 



See comment 1 . 



U.S. Department of Homeland Security 

Washington, DC 20528 



Homeland 
, tgjr Security 




July 12, 2006 

Mr. Jess T. Ford 
Director, International Affairs 
and Trade 
Government Accountability Office 
441 G Street NW 
Washington, DC 20548 

Dear Mr. Ford: 

Re: Department of Homeland Security Response to GAO Report (GAO-06-854) Border 
Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver 
Program. The Office of International Enforcement (OIE) has reviewed the draft report 
and welcomes this evaluation of our program and the Office. Our comments below 
concern several areas of confusion in the report, particularly with regard to management 
of the 2004 country review process, the elements of the review process, and changes 
made to the process since 2004. In addition we have provided comments on GAO's 
recommendations and an issue proposed for congressional consideration. 

I. Management of 2004 Review Process 

The draft report incorrectly characterizes OIE's role in the 2004 review process, in some 
places implying that OIE conducted the reviews and made determinations that countries 
should continue in the program (e.g. page 6) The report correctly notes that the 2004 
reports were initiated by the former Border and Transportation Security (BTS) Office of 
Policy in April 2004 and that OIE was created in July 2004, when the 2004 review 
process was well underway, to institutionalize coordination and oversight of VWP 
compliance activities. While OIE participated in the interagency working group process 
and immediately assumed oversight in July, the BTS Office of Policy continued to 
manage the preparation for and coordination of the site visits and site visit reports, the 
involvement of key interagency stakeholders, the gathering of information and the 
compilation of the country reports and related recommendations, and convening the 
meetings and preparing the agendas for the interagency working group where the 
information was discussed and evaluated and decisions made. When the reports were 
finalized, OIE assumed responsibility for coordinating clearance and evaluating the entire 
process. 

The 2004 country review process was an enormous undertaking to develop and finalize 
25 comprehensive, baseline reports with limited staff and support in a short period of 



www.dhs.gov 
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See comment 2. 



time. The 2004 reports are largely the outcome of an interagency working group process 
which included the Departments of Justice and State from the beginning to end and 
incorporated comments on every document produced during the 2004 review cycle. As 
the GAO draft report correctly notes, the interagency working group did not use 
qualitative or quantitative standards in determining which countries were considered 
countries of concern. The review process had not been institutionalized at the time it was 
initiated and relied on a draft (and continually redrafted) protocol. While the 2004 
process was a significant achievement, involving scores of individuals and organizations 
in a complex review process, and notable for what it accomplished, OIE agrees there 
were problems with that process; the Oversight Unit was in fact created to improve the 
process and recognized the need for improved organization and clarification of roles and 
responsibilities from the onset. 

As noted below, in some cases we do not agree with GAO's description of the problems 
encountered in the 2004 review. For example, key interagency stakeholders were in fact 
involved in the review process as appropriate to their area of expertise (GAO suggest that 
this was not the case). As GAO notes, the protocols for the country assessments, 
including internal milestones or deadlines for completing the final reports, the goals of a 
site visit and an explanation of the clearance process, which were unclear at the start of 
the process were developed by the interagency working group and continued to change 
during the 2004 review process. However, since the completion of the 2004 review, most 
of these problems have been corrected. 

II. Elements of the VWP Periodic Country Review Process 

The GAO draft report does not fully characterize the review process for VWP countries. 
As a result, some comments and statements contained in the report are not entirely 
accurate. One of OIE's first tasks was to develop a clear set of standard operating 
procedures for the periodic review process and the following overview demonstrates how 
this lengthy and complex process currently works. 

1) Review of relevant, previously obtained or collected and baseline country 
specific information (including any prior reports) Information pertaining to 
key VWP issues in all participating countries continually comes to OIE from 
many sources, where it is collected and evaluated continually. This information 
and information in previous country reports, if any, is reviewed as an initial step 
to assess and prioritize issues of interest and concern. 



2) Collect and review information obtained from the host country through a 
pre-site visit questionnaire submitted to posts Specific questions are often 
posed to the host government in a questionnaire submitted to posts so that the host 
government may directly respond and provide information; this process is not 
always necessary. At this stage, where this process is necessary, OIE seeks to 
narrow its focus and provide more explicit guidelines and directions for the site- 
visit team. 
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3) Collection and analysis of current background information collected from 
relevant USG offices Numerous offices in the USG are asked to provide specific 
data and information in their areas of expertise to assist in evaluating specific 
VWP countries. For example, the Human Smuggling and Trafficking Center 
provides information on country specific issues and the intelligence community 
provides intelligence information. 

4) Select, train, and deploy the site visit team to collect information from host 
government and USG officials, and collect the site team's completed draft 
site-visit report When the issues to be assessed are clarified, a team is selected to 
conduct a site visit based on their relevant expertise. The site visit team is able to 
directly question host government officials on issues of concern. Usually a site 
visit team will include an expert on immigration and border control issues 
(representative from Customs and Border Protection), an expert on forensic 
document and document security issues (representative from the Immigration and 
Customs Enforcement, ICE, Forensic Document Laboratory), an expert on 
intelligence issues (representative from DHS Intelligence Analysis) and an expert 
from State's Office of Consular Affairs. 

However, site visit teams are tailored to the issues of concern on the site visit 
(indeed, if there are no issues that need to be addressed directly with host 
government officials, a site visit may not be necessary) and may include fewer or 
additional participants, e.g., if investigative matters are involved, a representative 
from ICE will be included. Site visit team members are expected and instructed to 
be curious, to ask questions and deliver complete factual analyses, without 
personal interpretations (they are not asked nor expected to make an evaluation of 
VWP compliance). The team's responsibilities are completed once the site visit 
report is delivered, and are not expected to be involved in any further aspects of 
the larger and more intensive final country report which involves the evaluation of 
a great deal of additional information. 

GAO's draft report incorrectly suggests that this consultative process is 
inadequate and that additional review is necessary. Scores of individuals and 
organizations are involved in the review process and it would be extraordinarily 
cumbersome and ultimately not helpful for us to consult with each of them 
beyond their described functions to support the review process. 

5) Analyze all information and attempt to fill in any "gaps" After the conclusion 
of the site visit, OIE will take into account all information and data obtained, 
including the site-visit report, and determine whether or not additional 
information will be necessary to complete the full country report. In addition to 
reaching out to components and other to fill any information "gaps," at this 
juncture OIE begins to draft the congressionally required evaluation of US 
security, law enforcement and immigration interests. This stage of the review 
process necessitates the comparison and verification of information and 
approaches, sifting through concerns to discern what concerns are paramount, and 
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See comment 3. 



See comment 4. 



making final draft recommendations. This evaluation cannot be conducted at 
earlier stages of the review process (e.g., at the site visit as GAO appears to 
suggest) or before all the best information available is gathered and can be 
evaluated collectively. 

6) Prepare the draft individual country report and recommendations The 

individual country report includes a summary and OIE's preliminary 
recommendations (made in consultation as necessary with appropriate 
components) concerning the status of the country's participation in the VWP, and 
will include the site visit report as well as other baseline, background and 
analytical information. The individual country reports are prepared for the 
Secretary of DHS to help him make a decision whether to continue or terminate 
the country at issue in the VWP. The country reports are not intended for 
widespread distribution which is inappropriate because they contain sensitive 
foreign government information and are classified. The fact that an individual or 
agency was involved in collecting information on which a particular report is 
based does not mean that individual or agency has the requisite "need to know" 
the classified report. 

7) Consultation with DOS (and as necessary with DO J) on country report and 
recommendations A draft of the final report is forwarded to DOS for 
consultation. If there is agreement, the draft is finalized. If there are substantive 
differences between DHS and DOS, these will be included in the final report. 
While an interagency working group process was included as part of the 2004 
periodic reviews, this was necessary because of the issues involved. An 
interagency group will be used only when there is a clear need for further 
discussion and consultation. 

8) Prepare the final individual country report and summary report to Congress 

In the draft report, GAO repeatedly states that the 2004 reports were not 
completed in a "timely fashion and contained dated information that did not 
necessarily reflect the current risks posed by a country's continued participation 
in the program." However, the statutory requirement is to review countries every 
two years and, to do this and take the steps necessary to complete a report, reports 
cannot continue to incorporate data indefinitely. The information that was used in 
the 2004 reports was the best information available at the time the reports were 
finalized. 



9) Determination of security classification of report (paragraphing) using the 
Classification Guide Countries are open and forthcoming in the review process, 
providing extremely sensitive foreign government information because of their 
trust and confidence that the USG will not expose their vulnerabilities and 
concerns. This information, which is essential to the integrity of the country 
review process, is classified in accordance with our need to protect and maintain 
this level of trust and confidence. 
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10) Clear through relevant components and forward summary report to 
Congress The draft report notes the length of the clearance process in 2004. In 
that review process which involved extensive consultations, OIE was encouraged 
by National Security Council senior leadership to engage with countries with 
whom we had issues of concern proactively before the submitting the report to 
Congress. This collaboration boded well and enabled OIE to develop solutions 
with most countries in which concerns were raised. While such proactive 
engagement no doubt contributes to the length of the clearance process, it is in the 
USG's best interest for DHS to engage with countries on global concerns 
discerned in the course of these reviews and move forward with solutions, rather 
than to simply target problems. In defining deadlines and placing limitations on 
the clearance process, GAO may inhibit this kind of proactive consultation and 
engagement. Finally, it should be stressed that OIE involves stakeholders in the 
VWP review process as necessary, appropriate and relevant; statements to the 
contrary are simply incorrect. For example, site visit team members and posts are 
not expected or required to participate in reviewing, drafting or clearing the full 
country report; they do not have access to all the information that is provided in 
the country review process and their participation would only further contribute to 
delay these processes. 



III. Improvements Since 2004 



The draft report provides an outdated examination of the country review process, 
evaluating the 2004 process when that process was assessed, evaluated and significantly 
overhauled upon its completion. The assessment of the 2004 review process identified 
many problems, some of which are noted in the draft report, and these have already been 
corrected by OIE. Among these changes are: 

-Training for site visit team participants: Starting in 2005, OIE implemented a one- 
day training seminar for all site-visit teams before they are deployed. This training 
session describes the review process, as well as what is expected and not expected of 
participants before, during and after the site-visit. For example, the team leader is 
responsible for drafting the site-visit report and each participant contributes to his or 
her share of that report. This training session includes a DOS desk officer briefing, 
an intelligence briefing by Intelligence and Analysis, and extensive discussion of site- 
visit procedures and issues of concern. 

-Communication with overseas officials: Communication with posts is critical to 
the country review process. Communication with DHS overseas components is 
increasing and OIE consults frequently with headquarters components and has issued 
a series of cables and memos to provide information on VWP requirements and 
concerns. However, communication will remain an issue until we are able to 
implement our plan for continuous information management and communication 
outlined in our response to Recommendation 3, below. 
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-Standard Operation Procedures (SOPs) for the Visa Waiver Program 
Oversight Unit's operations and ongoing assessments to improve the process: 

Starting with the 2004 review, each review is assessed for lessons learned. SOPs 
describing procedures for each portion of the review process were developed by the 
VWP Oversight Unit after the 2004 review and are continually improved and updated 
as our operations progress. While procedures must be tailored to individual country 
issues, needs and requirements, these SOPs guide all the processes that are involved 
in the country review process and already include suggested timelines as 
recommended by GAO. Every effort is made to continue to streamline and improve 
this process. 



IV. Matter for Congressional Consideration 



See comment 5. 



GAO suggests that, given the length of time it took for DHS to issue the 2004 country 
reports and to ensure that they include timely information when issued; Congress may 
wish to consider establishing a biennial deadline by which DHS must report to Congress. 
Considerable thought needs to be given to the question of whether such deadlines will in 
fact serve to safeguard US security, law enforcement and immigration interests or 
whether they will be better served by requiring continuous engagement and review. OIE 
and the VWP Oversight Unit believe that rather than focus on imposing deadlines for 
evaluating US security, law enforcement and immigration interests that exist in a given 
prior 2-year period, Congress should require continuous and ongoing evaluation of US 
interests so that concerns, if discerned, are evaluated and resolved immediately and 
continuously in a time-sensitive manner and so that information is available to DHS 
component agencies to assist in efforts to make our borders more secure. The many 
reasons for the length of the country review process have been outlined above (see 
response to Recommendation 2, below). With continuous review and information 
management in place, OIE would be able to constantly evaluate US interests and report to 
Congress on the current 2-year reporting cycle on targeted issues of concern, rather than 
providing a biennial, or historical, "rearview mirror" evaluation. 



V. Responses to Specific Recommendations 



OIE has the following comments on the draft report's recommendations. The draft report 
recommends that the Secretary of DHS, in coordination with the Department of State and 
other appropriate agencies: 



Recommendation: 



Provide additional resources to strengthen OIE's visa waiver monitoring unit. 
Response: 

OIE appreciates the recommendation and is confident that the Administration will seek 
resources appropriate for the task. 
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Recommendation : 

Finalize clear, consistent, and transparent protocols for biennial country 
assessments and provide these protocols to stakeholders at relevant agencies at 
headquarters and overseas. These protocols should provide timelines for the entire 
assessment process, including the role of a site visit, an explanation of the clearance 
process, and deadlines for completion. 

Response: 

As noted above, OIE has established procedures for the Visa Waiver Program Oversight 
Unit's operations and the Oversight Unit is using them as flexible tools, tailored and 
revised for each review as necessary. These guidelines provide timelines for the specific 
portions of the clearance process, explain the role of the site visit and provide an 
explanation of the clearance process. We will consider providing these procedures to 
relevant stakeholders and USG agencies. However, the Visa Waiver Program Oversight 
Unit's procedures are designed with flexibility in mind and this flexibility is necessary to 
effectively evaluate the law enforcement, security and immigration concerns on a 
country-by-country basis. The Oversight Unit's SOPs provide internal guidance for this 
office and are not designed to be shared with overseas entities. Where deadlines are not 
able to be met by any entity involved in the review process (see the description in II, 
above), a note is made of this fact. The Oversight Unit's SOPs do not provide a deadline 
for the completion of a country review for several reasons - 

a. First, the length of each review is extremely variable, depending on such 
factors as the nature of the country under review, its history, geography 
and political issues; the issues of concern to USG security, law 
enforcement and immigration interests and their complexity and 
sensitivity; the availability of experts detailed to this office from other 
components to participate in site visits, who often have substantial 
obligations; the schedules and activities (e.g., holidays) at posts and in 
host countries and the availability of USG and host government officials; 
the work involved in preparing each report and the clearance process. 

b. Secondly, annual or biennial VWP reviews provide an ineffective 
"rearview mirror" (backward looking) examination of issues in lengthy 
reports that are almost immediately out of date, and OIE needs to move 
towards continual, ongoing review of issues of concern that come to its 
attention so that it is immediately responsive and engaged with countries 
on issues of concern to USG interests. In a "continual review" operation, 
reports can be generated for the USG at any time on general or more 
focused issues of concern. To be effective, the VWP Oversight Unit 
should stay current and engaged on issues of immediate concern, 
developing reports as needed, rather than be focused on developing 
lengthy reports on historical issues for specified trends. 
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Recommendation: 



Create real-time monitoring arrangements, including identifying visa waiver 
points of contact at U.S. embassies for all 27 participating countries and 
establishing protocols, in coordination with appropriate headquarters offices, for 
direct communication between points of contact at overseas posts and the Office 
of International Enforcement's Visa Waiver Program Oversight Unit. 



Response: 



OIE and the VWP Oversight Unit agree completely with this recommendation and 
have developed a strategy for continuous engagement with countries and overseas 
posts that would assign OIE/VWP Oversight Unit desk officers responsible for all 
VWP-related issues to countries within specific geographic areas. Under this plan, 
these OIE/VWP Oversight Unit desk officers are responsible for information 
management (continuous collection, evaluation and reporting) and for monitoring, 
coordination, outreach and continuous communication with embassies and posts 
within their designated areas. When appropriate resources are available, this platform 
for continuous engagement will be implemented immediately. It should be noted that 
these desk officers will be a critical part of answering questions, explaining 
requirements and engaging with countries on such issues as lost and stolen passport 
reporting. 



Recommendation: 



Provide complete copies of the most recent country assessments to relevant 
stakeholders in headquarters and overseas post. 



Response: 



See comment 7. 



The country reports are classified as SECRET documents, and therefore subject to the 
rules surrounding such documents. OIE has already established a classified sharing 
system which will allow access for appropriate agencies over the SIPRA-NET. As 
already noted above, country reports contain sensitive information and countries 
share this information openly during our reviews because they have trust and 
confidence that this information on their vulnerabilities, which might potentially harm 
them, is maintained and safeguarded appropriately. We need to continue to do 
everything we can to protect and safeguard sensitive foreign government information 
while making it available to those stakeholders with a need to know this information. 



Recommendation 

Require periodic updates from points of contact at posts in countries where 
there are law enforcement or security concerns relevant to the Visa Waiver 
Program. 
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Response: 

OIE agrees with this recommendation and notes that this will be easily accomplished 
when desk officers are assigned as stated in the response to Recommendation 3, 
above. 

Recommendation: 

Require that ail visa waiver countries provide the United States and Interpol 
with non-biographical data from lost and stolen issued passports, as well as that 
from blank passports. 

Response: 

DHS issued such policy in 2005 and the VWP Oversight Unit has developed and 
established the standards necessary to implement this policy, including the reporting 
of non-biographical data from lost and stolen issued and blank passports. Procedures 
for implementing the standards are currently in clearance. We agree that this issue is 
of paramount importance and, once standards are issued, noncompliance by VWP 
countries may lead to their termination from the program. However, to achieve 
compliance on this issue, we will need to work closely with the VWP countries that 
do not report on a regular basis at this time and monitor their cooperation and 
progress on this issue. 

Recommendation: 

Develop and communicate clear standard operating procedures for the 
reporting of lost and stolen blank and issued passport data, including a 
definition of timely reporting and to who in the U.S. government countries 
should report. 

Response: 

The VWP Oversight Unit has developed and established the standards necessary to 
implement this policy, including a definition of timely reporting, procedures for 
reporting, and to whom the information is reported in the USG. Procedures for DHS 
implementation of the standards are currently in clearance. 

Recommendation : 

Develop and implement a plan to make Interpol's stolen travel document 
database automatically available during primary inspection at U.S. ports of 
entry. 



Page 49 



GAO-06-854 Visa Waiver Program 



Appendix IV: Comments from the Department 
of Homeland Security 



Response: 

DHS, in coordination with DOJ and DOS, has been working with Interpol to identify 
the best methodology for screening travelers using the Interpol system. In January 
2006, DHS met with Interpol in Lyon, France to assess the viability and capabilities 
of the Interpol system. DHS has also spoken with Interpol and US National Central 
Bureau (USNCB) in Washington, D.C. and we have a process underway to develop 
connections and determine the rules and procedures that are necessary so that 
Interpol's stolen travel document database is made automatically available to 
immigration officers. DHS continues to maintain contact with Lyon and the US 
USNCB on these efforts and to take steps to develop a process that would allow 
Interpol information to be available to immigration officers. DHS will continue to 
work with Interpol and, while we cannot control Interpol functions at this time, we 
will help them move toward standards that will ensure regular and timely reporting. 

We thank yo°u again for the opportunity to review the report and provide comments. 



Sincerely, 



Steven J. Pecinovsky 

Director, Departmental GAO/OIG Liaison Office 
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q^q QofQjjigj-^g 1- We understand that DHS's organizational structure changed during the 

v " " ""' " ■ ■»-■■-■ ^ >■ > 2004 review process. To avoid confusion regarding the DHS units that 

had some involvement in this process, we have replaced references to 
the Office of International Enforcement (OIE) with DHS, as 
appropriate. 



2. Our review focused on the 2004 biennial review process for 25 of the 
27 Visa Waiver Program countries. We agree that DHS has taken some 
steps to improve the 2005 process for Italy and Portugal, whose 
reviews are still in process, and we discuss these improvements in our 
report. However, we disagree that DHS has corrected most of the 
problems associated with the 2004 review process. As we note in our 
report, as of June 2006, DHS had neither updated the interagency 
working group team members on the status of the reviews of Italy and 
Portugal, nor provided them with a timeline for proceeding with the 
review. Furthermore, stakeholders continued to express concern 
about DHS's lack of communication about the process and the 
findings. Therefore, we recommended that DHS finalize clear, 
consistent, and transparent protocols for biennial country assessments 
and provide these protocols to stakeholders at relevant agencies at 
headquarters and overseas. 

3. We did not intend to suggest that the evaluation of U.S. security and 
law enforcement interests needed to be conducted or finalized during 
the in-country site visits. Our point is that important events may take 
place while the country assessments are in the clearance process. We 
believe that DHS should update the country assessments to reflect 
these events, such as large scale thefts of blank passports like the May 
2005 theft that we noted in our report, to ensure that Congress has a 
comprehensive analysis of the current law enforcement and security 
risks posed by each country. 

4. We agree that DHS cannot continue to incorporate data indefinitely 
into the country assessments. However, as we reported, the teams 
collecting information about the visa waiver countries' risks in 2004 
used, in some cases, information from 2 years prior; by the time the 
summary report was issued in November 2005, some of the data was 
more than 3 years old. Indeed, as DHS noted elsewhere, the 2004 
country assessments provided a "rearview mirror" and "backward- 
looking" evaluation. Thus, the assessments may not necessarily have 
contained the best information available at the time the assessments 
were finalized. Given the lengthy time it took for DHS to issue the 
November 2005 summary report to Congress, and to ensure future 
reports contain timely information when issued, we believe that 
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Congress should consider establishing a biennial deadline by which 
DHS must complete the country assessments and report to Congress. 

5. We agree that continuous and ongoing evaluations of Visa Waiver 
Program countries are needed and recommended that DHS create real- 
time monitoring arrangements and provide additional resources to the 
Visa Waiver Program Oversight Unit to achieve this goal. However, as 
long as DHS is required to report biennially to Congress, DHS should 
ensure that future reviews are conducted in a timely fashion. Based on 
our review of the 2004 country assessment process, the assessments 
may not necessarily have contained the best information available at 
the time the assessments were finalized given the lengthy time it took 
for DHS to finalize its reviews. 

6. We agree that it is in the U.S. government's best interest to engage with 
countries on global concerns identified during the course of the 
country assessment process. It is not our intention to inhibit this kind 
of consultation. Furthermore, we acknowledge that a consultative 
process may involve tradeoffs between timely reporting and complete 
information gathering and analysis. Our concern is that key 
stakeholders in headquarters and at overseas posts, as well as 
members of the in-country site visit teams, expressed concerns about 
their roles in the 2004 country assessment process, and stated that 
they had not received enough detail from DHS about the process and 
the findings. Thus, we recommended that DHS provide transparent 
protocols to all stakeholders that provide timelines for the entire 
assessment process, including the role of a site visit, an explanation of 
the clearance process, and deadlines for completion. We believe it is 
important that DHS finalize its standard operating procedures, and 
share these procedures with relevant stakeholders at headquarters and 
overseas. As we noted in our report, due to the lack of outreach and 
clear communication about its mission, OIE is limited in its ability to 
monitor the day-to-day law enforcement and security concerns posed 
by the Visa Waiver Program, and the U.S. government is limited in its 
ability to influence visa waiver countries' progress in meeting 
requirements. 

7. We strongly agree that classified and sensitive information should be 
protected. However, we also believe that cleared U.S. officials at 
overseas posts in Visa Waiver Program countries, including 
ambassadors and deputy chiefs of mission, have a need to know the 
extent to which law enforcement and security concerns were 
identified during the mandated biennial reviews, and should receive 
copies of the final country assessments. Without the appropriate 
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information, such as was contained in the assessments, embassy 
officials can not be effective agents for the U.S. government with 
regard to these issues. We believe that the establishment of a classified 
sharing system that allows U.S. government agencies to access the 
country assessments is a positive step. 
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United States Department of State 

Assistant Secretary for Resource Management 
and Chief Financial Officer 

Washington, D.C. 20520 

Ms. Jacquelyn Williams-Bridgers ^3 fSK' 

Managing Director 

International Affairs and Trade 

Government Accountability Office 

441 G Street, N.W. 

Washington, D.C. 20548-0001 

Dear Ms. Williams-Bridgers: 

We appreciate the opportunity to review your draft report, 
"BORDER SECURITY: Stronger Actions Needed to Assess and Mitigate 
Risks of the Visa Waiver Program," GAO Job Code 320389. 

The enclosed Department of State comments are provided for 
incorporation with this letter as an appendix to the final report. 

If you have any questions concerning this response, please contact 
Debbie Lopes da Rosa, Consular Officer, Bureau of Consular Affairs, 
at (202) 663-1 175. 



Sincerely, 




cc: GAO - Jess Ford 
CA - Maura Harty 
State/OIG - Mark Duda 
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Department of State Comments on GAP Draft Report: 

BORDER SECURITY: Stronger Actions Needed to Assess 
and Mitigate Risks of the Visa Waiver Program 
(GAO-06-854, Job Code 320389) 

Thank you for the opportunity to respond to your report Stronger Actions 
Needed to Assess and Mitigate Risks of the Visa Waiver Program. The 
Department of State concurs with the GAO that a strong and secure Visa 
Waiver Program (VWP) offers substantial benefits to the United States in 
the areas of international travel, trade, and commerce. The VWP also allows 
the Department to deploy limited consular resources to locations where the 
risk of immigration and other border security violations is higher. A 
properly administered VWP is a strong component of the U.S. "Secure 
Borders, Open Doors" commitment. 

The Department of State has worked closely with the Department of 
Homeland Security (DHS) and other agencies in a joint effort to strengthen 
the VWP. As noted by the GAO, these efforts over the past five years have 
included the removal of two countries from VWP membership, greatly 
enhanced requirements for document security and integrity, and the 
imposition of VWP travel conditions on countries that have failed to meet 
the new requirements or satisfy other U.S. border security concerns. The 
Department continues to maintain an active and productive dialogue with its 
VWP partners on border security, recognizing that international travel, by its 
very nature, requires mutual cooperation. U.S. Embassies and Consulates in 
VWP countries, as well as Department offices in Washington, have provided 
substantial support to DHS' efforts to monitor and assess the VWP, and we 
will continue to do so. The Department agrees with the GAO that these 
efforts would benefit from enhanced communication to and from DHS and 
endorses an expansion of DHS information- sharing on VWP issues. 

The Department of State also acknowledges the risk of misuse of previously 
lost or stolen passports to seek admission to the United States, particularly, 
in our experience, by persons who are not eligible for a visa. With regard to 
ensuring timely reporting on lost and stolen passports, we welcome the 
report's recommendations related to establishing clear guidelines and 
reporting mechanisms. Good communication with the VWP countries to 
articulate U.S. objectives and concerns related to lost and stolen passport 
reporting is absolutely critical for ensuring compliance with program 
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requirements and guidelines and to address legitimate outstanding country 
concerns related to such reporting. Lost and stolen passport reporting is an 
especially complex matter, involving such issues as different legal 
restrictions on sharing data among VWP participating countries, varying 
passport numbering schemes, and the need for clear identification of data 
elements and personal information not currently collected in some VWP 
countries. Implementing data-sharing measures relative to lost and stolen 
passports is further complicated by the potential difficulties of lost and 
stolen passport hits for legitimate travelers, mechanisms to facilitate 
government-to-government sharing of appropriate information in such cases 
to resolve such hits, and the limitations on the ability of Interpol's reporting 
system to assist border inspectors in the admissions process. Again, the 
nature of international travel requires dialogue and mutual cooperation to 
find effective solutions to these challenges, and the Department is working 
actively with DHS to address all these concerns. 

In its report, the GAO took issue with delays in finalizing the DHS report to 
Congress on the Visa Waiver Program. The Department would emphasize, 
however, that actions taken to address vulnerabilities in the VWP were not 
dependent on final publication of the report and were in fact undertaken 
soon after the Inter-agency Working Group identified them - more than six 
months before completion of the final report. We will continue to work 
with DHS to address any identified VWP security concerns as quickly as 
possible, irrespective of publication schedules. Our mantra is that border 
security is a 24/7 responsibility, and we act accordingly. 
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Ronald K. Noble 



13 July 2006 



Our Ref. : 

2006/!432/OS/JG/sf 
Subject : 

GAO report on the Visa Waiver Program 



Dear Director Ford, 

I would like to thank the GAO for its interest in the tools that Interpol makes available to help its 
member countries secure safer borders for their citizens. 

Background 

By 2001, Interpol had identified the use of falsified stolen passports by terrorists and other criminals 
as a significant threat to international border security. No global central repository for information on stolen 
and lost travel documents existed at that time. This resulted in a situation with serious loopholes in national 
border security systems, which were being exploited by terrorists and other criminals. 

As the world's only global law enforcement organization, with 184 Member Countries, Interpol took 
the view that it was in the best position to address this challenge, and we made it one of our highest priorities 
to create a global database of stolen and lost travel documents. 

The SLTD Database 

We launched our Stolen and Lost Travel Documents (SLTD) database in 2002. It contains passport 
numbers and information about the place and date of the theft or loss of the passports. It does not contain any 
nominal information that might implicate any privacy concerns. Interpol made this database available to all of 
the world's police forces through our global secure police communications system, called 1-24/7. This meant 
that it was available at the Interpol National Central Bureau in each country. 

At the time we implemented the database, only a handful of countries actively contributed information, 
but participation has since grown to 107 countries, including 23 out of the 26 Interpol Member Countries that 
participate in the US Visa Waiver program. Similarly, the number of documents recorded in the SLTD 
database has increased dramatically. In just four years time, that number has grown from less than 3,000 to 
over 11.6 million, and continues to grow daily. 
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Thc United Nations Security Council, the G-8, the European Union, and the Asia Pacific Economic 
Cooperation (APEC), the Organization for Security and Cooperation in Europe (OSCE) and the International 
Civil Aviation Organization (ICAO) have all endorsed the use of this database as an effective tool against 
terrorism. The reason is straightforward. 

As the 9/1 1 Commission found - "For terrorists, travel documents arc as important as weapons. 
Terrorists must travel clandestinely to meet, train, plan, case targets, and gain access to attack." After a 
terrorist attack, police frequently discover that the perpetrators were known suspects who had been traveling 
around the world plotting and executing their attack, while concealing their identities through the use of false 
passports. Stolen passports, particularly those stolen in blank form, present the greatest threat because they 
can be made into false passports that arc among the most difficult to detect. They arc highly prized by 
terrorists, commanding high prices on the black market, and arrested terrorists arc often found in possession of 
them. 

It has been reported, for example, that Ramzi Yousef, the mastermind behind the first World Trade 
Center bombing, entered the US using a falsified stolen Iraqi passport. Had the authorities known this at the 
time, that bombing may have been prevented. 

Even with the heightened security following 9/1 1, the US government has documented cases in which 
aliens have entered the country using falsified stolen passports, including some from a foreign city that was 
home to an at Qacda coll that played a significant role in supporting the 9/ 1 1 terrorists. 

An individual named Ante Gotovina was wanted for War Crimes and Crimes Against Humanity. He 
used a falsified stolen passport to conceal his identity. The passport was listed in Interpol's database, but 
because border authorities were not checking this database, Gotovina' s passport was stamped in 16 countries 
before he was finally apprehended in 2005. 

In 2003, Serbian Prime Minister Zoran Djindic was assassinated by a man who was charged with 
having used a falsified stolen passport to travel extensively in planning and carrying out the assassination. His 
passport was stamped 26 times before he was finally captured. 

Automated Access to the SLTD Database at Primary Inspection 

To address this threat, Interpol developed technology that allows law enforcement officers to instantly 
check the Interpol Stolen and Lost Travel Document (SLTD) database at airports and other border entry 
points. There arc no extra steps; the same swipe of the passport automatically checks the Interpol database in 
parallel wilh the check of the national database. This technology (called MIND/FIND), which is 
revolutionizing the way countries conduct border security, was launched in December in Switzerland. Using 
this technology, the Swiss conduct more than 300,000 database searches per month. And these searches get 
results — each month the Swiss detect over 100 persons travelling with false passports. These numbers bear 
witness to the urgent need for all countries to implement Interpol's MIND/FIND technology. 

France (Charles de Gaulle), Belgium and Lithuania have recently implemented it, and a small, but 
growing number of other countries arc in the process of doing so as well. The US is among these countries, 
along with Spain, The Netherlands, Turkey, Croatia, The Bahamas, Saint Lucia, Jamaica and South Africa. 
As more countries implement this technology, more terrorists and other dangerous criminals will be 
apprehended at airports and other border entry points. 

The best way for a country' to protect its citizens from terrorists is to prevent the terrorists from 
entering the country in the first place. Unfortunately, in conducting border security, most countries check only 
their own national database, and do not check Interpol's global database. This should no longer be considered 
acceptable. Now that the global database exists, as well as the technology to access it at airports and other 
border entry points, doing so should be considered a moral imperative. 
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Just imagine if a terrorist were to enter your country using a passport that is listed in Interpol's SLTD 
database, but your country failed to check this database, and this failure allowed the terrorist to perpetrate a 
deadly attack. How could that failure ever be justified? To ask this question is to answer it. The time has 
come for all countries to implement automated access to Interpol's SLTD database at all airports and other 
border entry points where passports arc checked. 

The more countries that implement such access, the more effective the global law enforcement 
community will be in preventing terrorists from travelling throughout the world in order to plan and execute 
their attacks. For this reason, we will continue to engage with the US and other member countries, working 
with them to roll out primary border control access to this database whenever possible. 

Worldwide Implementation 

Unfortunately, many countries lack the resources to implement this technology. This means that there 
will be dangerous gaps in global security unless other countries devote resources to help plug these gaps. In 
other words, the wealthier countries must help the poorer countries as a matter of enlightened self interest. 
The poorer countries are often in possession of information that could be of great interest to law enforcement 
in other countries. In addition, it is in the interest of all countries to work together to enhance the likelihood of 
the detection and apprehension of terrorists wherever they may be found. Terrorists arrested in another 
country are thereby prevented from appearing in your country. 

Keeping citizens safe from terrorists and other dangerous international criminals requires a 
comprehensive global approach. For the world's wealthier countries, it is no problem to implement automated 
access to Interpol's SLTD database. The problem is that the poorer countries cannot afford to do so. Interpol 
believes that this technology can be implemented at all of the world's poorer countries for approximately $65 
million. This is an exceedingly small price for wealthy countries, such as the US, to pay in order to gain this 
heightened security. I would urge the US and other wealthy countries to provide this funding so that Interpol 
can implement this important law enforcement tool worldwide. 

I look forward to continuing to work with law enforcement in the US and elsewhere towards our 
shared objective of keeping the world's citizens safe from terrorists and other dangerous international 
criminals. 

Yours sincerely, 




Ronald K. Noble 
Secretary General 



ee: Mr Martin Rcnkicwicz 
Head US NCB 

Mr Jess T. Ford 

Director International Affairs and Trade 
U.S. Government Accountability Office 
441 G Street, NW 

Washington, DC 20548, United States 
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